fix(tri-api): harden permission and MCP metadata ownership

[dmitrii-f-t27]

Summary

Closes #1197

First scoped hardening patch; does not claim complete security remediation. S07 worktree untouched. See docs/TRI_API_SECURITY_RESULTS.md.

{
  "version": 1,
  "head_sha": "c5f4fa033065c2b2972608d7f530fd10460f3cf5",
  "summary": "Harden parsed permission configuration and MCP discovery lifetimes, fail closed on invalid settings, and reject invalid writes before checkpoints.",
  "changes": [
    "Own permission strings and use structural JSON settings parsing.",
    "Own MCP metadata, validate initialization response and parse discovery once.",
    "Validate writes before checkpoints and tighten lexical paths and shell separators."
  ],
  "tests": [
    {
      "command": "zig test --sysroot \"$SHIM\" -O \"$MODE\" src/tri-api/tool_executor.zig (Debug, ReleaseSafe, ReleaseFast, ReleaseSmall)",
      "status": "passed",
      "result": "24 tests pass in each mode; includes permission and local MCP handshake tests.",
      "evidence": "reports/tri-api/security-2026-09-30/"
    },
    {
      "command": "zig build-exe --sysroot \"$SHIM\" -O Debug --dep token_rotator -Mroot=src/tri-api/main.zig -Mtoken_rotator=src/tri/token_rotator.zig",
      "status": "passed",
      "result": "Full Debug executable compiled with Zig 0.15.2 and local macOS sysroot shim.",
      "evidence": "docs/TRI_API_SECURITY_RESULTS.md"
    }
  ],
  "limitations": [
    "Local validation only; CI and deployment not yet verified.",
    "Not a full filesystem or process sandbox; symlink containment, shell capability policies and MCP timeouts remain.",
    "Provider error handling, usage and context compaction not modified."
  ],
  "tags": [
    "Engineering",
    "Verification"
  ],
  "blog": {
    "title": "Memory ownership and fail-closed configuration in tri-api",
    "summary": "A scoped hardening change verified with local regressions across four Zig optimization modes, with explicit remaining security boundaries.",
    "outline": [
      "Permission configuration and MCP metadata own their storage instead of depending on temporary parsing buffers. Invalid existing settings reject tool execution.",
      "Local regression tests exercise configuration lifetimes, malformed settings, metadata discovery and a Python MCP handshake fixture. All four Zig optimization modes pass.",
      "This change is not a complete sandbox. Filesystem confinement, shell capability policy, provider errors and request timeouts remain separate work requiring additional evidence."
    ]
  }
}

[gHashTag]

Reviewer bee Y: skipped -- the PR is a DRAFT, so the author has not offered it for merge. Noted for the later review: T27 work report is green; red here and to check against main: 'Render VHS tapes to GIFs', docs-check 'Check Documentation Links' and 'Documentation Consistency' (Brain Health and pr-opened are red on main too). It also commits four tool_executor-*.log files under reports/, which are build output, not source.