Runtime config mutation for RPC namespaces (7 TODOs)

[Destynova2]

Context

7 TODO: markers in src/server/rpc/{config,hit,pledge,tools}_ns.rs flag missing support for runtime config mutation with config reload. Currently these namespaces expose read APIs but no mutations — any state change requires a TOML edit + process restart (or /api/config/reload call).

Scope

File	Line	What's missing
config_ns.rs	42	In-memory config mutation with validation
hit_ns.rs	50	Runtime policy mutation with config reload
hit_ns.rs	91	Build RequestContext from JSON and run matcher.resolve()
pledge_ns.rs	30	Runtime pledge activation with config mutation
pledge_ns.rs	46	Pledge clear with config mutation
tools_ns.rs	56	Runtime tool enable with config mutation
tools_ns.rs	73	Runtime tool disable with config mutation

Linked to

• Phase A T-A1 ControlEngine shipped (PR feat(control): implementer le moteur ControlEngine generique #174) — read path done
• Phase B roadmap — observability / UI will consume this surface
• Audit 2026-04-18 item 41

Non-goals

• Hot-reloading the entire config via RPC (already handled by /api/config/reload)
• Persistent mutations — these RPCs should write to an overlay store, not config.toml