fix(lp3): remediation and docs name allowed-tools for SKILL.md

[ppcvote]

Closes #313.

LP3's detection logic on main already accepts allowed-tools as a valid declaration (mcp_least_privilege.py — permissions_absent = (permissions is None or permissions == []) and not allowed_tools), but the guidance layer was left behind: the runtime remediation string, the pattern_defaults.py fallback strings, and the docs/B.3.1 LP3 section all direct authors to add a permissions field. As #313 lays out, permissions is not part of the Claude Code / Agent Skills SKILL.md frontmatter schema — an author who follows the advice adds a key the runtime ignores, and LP3 keeps firing. The finding wasn't actionable by its own remediation.

What changed (strings only — no behavior change)

• Remediation (both mcp_least_privilege.py and the pattern_defaults.py fallback — they'd otherwise drift): names both fields and says which applies to which manifest type: allowed-tools frontmatter for Claude Code / Agent Skills SKILL.md, permissions list for MCP server manifests.
• Finding message + LP3 description: "declares no tool scope ('permissions' or 'allowed-tools')" instead of "no declared permissions", matching the trigger condition the code actually implements.
• docs/B.3.1-mcp-least-privilege.md LP3 section: Triggers when / Example / Remediation updated the same way; the docs note explicitly that permissions is ignored in SKILL.md so nobody round-trips through the dead key again.

Scope note: LP1/LP4 doc wording could arguably get the same manifest-type clarification, but #313 is specifically about LP3's dead advice, so this PR stays there — happy to follow up if wanted.

Testing

• tests/test_mcp_least_privilege.py: 15/15 pass (no test pins the remediation strings).
• Full suite on this branch: 1519 passed; 4 pre-existing failures reproduce identically on a clean main checkout on Windows (test_create_github_release ×2, test_build_context_records_non_regular_entries_in_the_ledger, one YARA encoding case) — unrelated to this change, and consistent with the Windows-environment gaps described in claude_cli provider: concurrent temp-file collision on Windows drops most files from LLM analysis ([WinError 32]) #315.

🤖 Generated with Claude Code

[rng1995]

[Automated SkillSpector Review]

Approved. This aligns LP3's finding text, remediation, defaults, and documentation with the detector's existing allowed-tools support. It correctly directs SKILL.md authors to allowed-tools while retaining permissions for MCP manifests, with no detection or schema behavior change. The focused LP suite passes (15 tests).

[ppcvote]

Checked this against current main — still mergeable, no conflicts, no branch update needed, and the approving review from 07-31 still stands.

Flagging only because it is easy for an approved PR to fall off the list: this closes #313, and the failure it fixes is that the remediation string tells an author to add a permissions key that the runtime does not read, so following the advice leaves LP3 firing anyway. The detection side on main already accepts allowed-tools; this is the guidance layer catching up to it.

Happy to rebase, split, or adjust anything if it would help.