Harden MCP tool filter invalid configuration and known-tool drift

[Widthdom]

Found while dogfooding the locally built cdidx on branch codex/search-audit-issues-20260619.

Duplicate check: no open issue found for McpToolFilter allow deny tool filter invalid config drift.

Evidence:

• src/CodeIndex/Mcp/McpToolFilter.cs:108 starts from all known tools, and if a denylist is specified but invalid, it leaves all tools enabled.
• src/CodeIndex/Mcp/McpToolFilter.cs:42 keeps KnownToolNames as a manually maintained list separate from tool definitions and dispatch contracts.

Problem:
MCP tool gating is an operational security boundary. Invalid deny configuration should not silently expose the full tool surface, and manually duplicated tool lists can drift from actual advertised/dispatchable tools.

Acceptance criteria:

• Decide and document fail-closed behavior for invalid denylist values; prefer disabling the filter target or all tools rather than silently allowing all.
• Emit structured/bounded diagnostics for invalid allow/deny filters so operators can detect misconfiguration.
• Derive known tool names from the same source used by tool definitions/dispatch where feasible, or add tests that prove the lists cannot drift.
• Add tests for overlong denylist, too many deny entries, unknown names, empty allowlist, and definition/dispatch parity.

[Widthdom]

Work started on branch fix-issue3815-3756-3829-3780-3752-3753-3789.