[7/8] M6: Add direct headless MCP runtime

[provencher]

Summary

• Extract the standalone MCP capability substrate and add the opt-in direct --backend headless stdio runtime while preserving the app proxy as the default.
• Keep one canonical 27-tool schema authority, with a deterministic readable generated review projection; expose the expected 20-tool policy-filtered direct/app client surface.
• Close final security and lifecycle review findings: verified run-scoped direct principals, exact selection/prompt operation grants, authoritative-root worktree containment, bounded stdio backpressure provenance, and explicit allow/deny coverage.
• Preserve private child endpoint / single-use launch-token routing and bounded runtime drain ownership.

Acceptance evidence

• Coordinated ad-hoc debug package/relaunch: conductor ticket 09deea60-349e-4c21-bf38-d9993b913254; installed rpce-cli-debug resolved to the activated DebugApps helper.
• Non-disruptive app smoke: ticket e3efa004-0e29-47df-b2c1-c13170060be7.
• App proxy: policy-filtered catalog/read passed; temporary manage_selection mutation was observed and restored.
• App Agent Mode: session 0320C923-A867-4A8B-B3EE-CF53159C91F6 completed with M6_AGENT_RUN_SENTINEL_OK.
• Direct no-app stdio: initialize, 20-tool catalog, isolated read_file, plan-approved manage_selection + prompt mutations, cleanup, and EOF exit 0 with empty stderr.
• Private endpoint/token carrier fixture: DirectHeadlessChildEndpointTests 2/2 passed (ticket 7bd9277e-c8c2-4af5-a63c-96371c35902c).
• Explicit headless interactive/exec modes reject with exit 2; omitted and explicit --backend app routes matched.
• Focused domain/direct/transport/schema suites, 3,760-test ledger verification, strict lint, and both RepoPrompt / repoprompt-mcp product builds passed. Push preflight scanned the 63-commit outgoing range with no leaks and all guardrails green.

Known blocker

make dev-codex-schema-check remains environment-blocked on this host because installed codex-cli 0.144.1 is below the required 0.145.0 floor. The gate was not bypassed.

Series

PR 7/8. Base is feature/headless-runtime-m5-ai-agent; M7 remains out of scope.