fix(mcp): sandbox tool handlers to allowed filesystem roots

[runonthespot]

Problem (security: HIGH)

Every MCP tool handler accepted `request.path` verbatim:

```rust
let path_buf = PathBuf::from(request.path);
```

The only validation was an existence check. An agent connected over MCP could ask ck to index or semantically search any path readable by the host — `/etc`, another user's home, anything. `McpContext` stored a `cwd` field but nothing in the request pipeline enforced it.

Found via code review (task #9).

Fix

1. `McpContext::allowed_roots: Vec` — canonical roots the MCP server is permitted to touch. Defaults to `[canonical(cwd)]`. Operators can extend via `CK_MCP_ALLOWED_ROOTS` env var (colon-separated, like `PATH`).
2. `McpContext::resolve_request_path(raw) -> Result<PathBuf, ErrorData>` — parses the raw string, joins relative against cwd, rejects empty / non-existent paths with `invalid_params`, canonicalizes the result (so symlinks resolve), then verifies containment against `allowed_roots`.
3. All 6 tool handlers (`semantic`, `lexical`, `regex`, `hybrid`, `index_status`, `reindex`) replace `PathBuf::from(path)` + ad-hoc existence check with one `resolve_request_path` call.

Tests (all 7 pass under `--no-default-features`)

• `accepts_existing_path_inside_root`
• `accepts_relative_path_inside_root`
• `rejects_absolute_path_outside_root` ← the primary escape vector
• `rejects_dot_dot_escape` ← `../..` traversal
• `rejects_symlink_pointing_outside_root` (unix-gated) ← symlink trickery
• `rejects_empty_path`
• `rejects_nonexistent_path`

Notes

• Independent of PR fix(ck-engine): apply path scope before top_k in semantic search #111 — touches `ck-cli/src/mcp/*` only.
• Future work: extend allowed_roots config to a config file or per-tool overrides if operators need finer control. Env var is the minimum-viable knob.
• Operator-visible behavior change: requests for paths outside the sandbox now fail with a clear `invalid_params` error mentioning `CK_MCP_ALLOWED_ROOTS`, instead of silently scanning them.

Test plan

• `cargo test -p ck-search --no-default-features --lib sandbox_tests` — 7/7 pass
• `cargo clippy -p ck-search --all-targets -- -D warnings` — clean
• `cargo fmt --all --check` — clean
• CI green

🤖 Generated with Claude Code