feat: make MCP target selection explicit

[Opperiesen]

Summary

• introduce MCP contract v2 with additive config_path and profile selectors;
• resolve every controller-facing tool through the shared target resolver;
• expose sanitized target envelopes and target-bound plans;
• keep environment-only version-1 target resolution callable and document the response migration;
• retain the adapter as read-only.

Validation

• uv run pytest -q: 60 passed, 4 skipped
• uv run ruff check .
• uv run ruff format --check .
• uv lock --check
• git diff --check

Closes #45.