fix(mcp): blunt slop oracle score output and add per-actor tool rate-limit

[JSONbored]

Summary

Hardening for gittensory_check_slop_risk and gittensory_check_issue_slop:

Score blunting: the exact slopRisk (0–100) and SLOP_RUBRIC_MARKDOWN (band thresholds) are no longer returned. Callers receive only band (clean/low/elevated/high) and findings. Without the exact weight-per-signal and the band thresholds in the response, an adversary can't call the tool with one controlled signal active, read the score, and map it directly to a SLOP_WEIGHTS entry — they'd need many more experiments with no ground-truth to anchor on. The tool still fully communicates what would block a PR; only the enumerable internal constants are withheld.

Per-actor rate-limit: a tight per-actor cap (20 calls / 5 min, keyed on mcp-tool:{toolName}:{actor}) is enforced at tool-dispatch time using the existing RATE_LIMITER Durable Object. This sits inside the existing IP/token HTTP rate-limit and catches actor rotation (same IP, multiple tokens). Fails gracefully when RATE_LIMITER is absent.

Tool descriptions updated to not promise slopRisk (0-100) or the rubric. Existing tests updated to assert on band + findings; new tests cover all four rate-limit branches.

Scope

• src/mcp/server.ts — blunt output, add enforceToolRateLimit, update descriptions, remove unused rubric imports
• test/unit/mcp-check-slop-risk.test.ts — update to assert band+findings (not score/rubric)
• test/unit/mcp-output-schemas.test.ts — 5 new tests covering score blunting + all rate-limit branches

Validation

• npm run test:ci — 3 734 tests pass

Safety

• No auth or CORS changes
• Rate-limit is a tighter inner constraint on top of existing HTTP-level limiting; graceful skip when DO absent
• Tool behavior for legitimate use cases is unchanged — band + findings are all a developer needs to self-check

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 88.88889% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 94.80%. Comparing base (1bc3ee6) to head (2210352).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/mcp/server.ts	88.88%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1194      +/-   ##
==========================================
- Coverage   94.80%   94.80%   -0.01%     
==========================================
  Files         157      157              
  Lines       19090    19099       +9     
  Branches     6912     6915       +3     
==========================================
+ Hits        18098    18106       +8     
  Misses        399      399              
- Partials      593      594       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.