fix(mcp): Align context and status surfaces

[reneleonhardt]

What does this PR do?

Keeps MCP results honest and deterministic: ordinary text is bounded to the output budget, legacy JSON responses stay complete, project paths resolve to native/request-local roots (including ~ home expansion), and the status surface is stable and exact. The tool inventory is served by the protocol's tools/list (the SDK's live registry) instead of a hand-maintained embedded list that could drift from the registered set.

Type of change

• Bug fix
• New feature
• New language support
• Documentation
• Other (describe below)

Checklist

• I've tested this locally with go build && ./codemap .
• I've read CONTRIBUTING.md (for new language support)
• I've updated documentation if needed

Additional notes

• Bounds ordinary text and status output to limits.MaxContextOutputBytes; completeJSONResult preserves complete, valid JSON.
• Deterministic status/watcher/activity ordering; exact-surface contract asserted against the protocol tools/list.
• Native, request-local project roots; ~/ paths expand via $HOME.
• ~500 lines of exhaustive surface tests (call-site classification, bounding, determinism, inventory, request-local roots).

Developed with carefully directed, manually reviewed AI assistance.

[JordanCoin]

Verified independently. The status tool was advertising 10 tools while 16 are registered — deleting that hand-maintained list is a real truthfulness fix, and a list like that could only ever drift. Confirmed the new tests aren't vacuous: reverted the source to main and 8 of 10 fail with the exact symptoms claimed.

Noted for follow-up, not blocking: mcp/main.go:334 uses os.Getenv("HOME") for ~ expansion, which is unset on Windows (os.UserHomeDir() reads USERPROFILE), so ~/proj resolves against the server's cwd. It's propagation rather than regression — 8 such sites on main, 9 here — and skills/loader.go:40 already has the right idiom. Worth knowing that CI's test matrix is ubuntu+macos only, so this class is invisible to CI.