feat(mcp): output JSON Schema validation gate in boruna_run (closes #8)

[escapeboy]

Sprint 0.5-S6 — closes #8 (FleetQ P2, fourth in a row)

Lets integrators drop their host-language JSON Schema validation layer — Boruna validates the agent's return value before yielding it, with structured per-path errors. Pulled forward from 0.5.0 because FleetQ wanted it in their pipeline; same logic that worked for #6 (lock the surface before 0.5 freezes it).

What's in this PR

MCP surface

boruna_run({
  source: \"...\",
  output_schema: {
    \"type\": \"object\",
    \"required\": [\"status\", \"items\"],
    \"properties\": {
      \"status\": { \"type\": \"string\", \"enum\": [\"ok\", \"warn\"] },
      \"items\":  { \"type\": \"array\", \"minItems\": 1 }
    }
  }
})

Mismatch returns:

{
  \"success\":      false,
  \"error_kind\":   \"validation_failed\",
  \"phase\":        \"output_validation\",
  \"message\":      \"result does not match output_schema\",
  \"errors\":       [{ \"path\": \"/status\", \"message\": \"...\" }, ...],
  \"truncated\":    false,
  \"total_errors\": 3,
  \"steps\":        <vm.step_count() at successful completion>
}

Malformed/oversized schema:

{ \"success\": false, \"error_kind\": \"invalid_output_schema\", \"message\": \"...\" }

Hard limits (locked)

• 256 KB max schema size (compact JSON bytes). Larger → `invalid_output_schema` before compilation.
• 100 errors max in response (matches `TRACE_LIMIT` pattern). Pathological schemas can produce thousands; cap protects MCP transport. `truncated: true` + `total_errors: N` when exceeded.
• Draft 2020-12 enforced. Schemas declaring non-2020-12 `$schema` are rejected at parse time, not silently honoured at older-draft semantics. Same "reject at parse, don't silently override" pattern as 0.3-S10's `unsupported_limit` for `max_memory_mb`.

Known limitation (documented loudly)

`format_value` emits Boruna records/enums/Some/Ok as wrapper JSON:

Boruna value	JSON shape
`Record`	`{"type":"record","type_id":N,"fields":[positional values]}`
`Enum`	`{"type":"enum","type_id":N,"variant":,"payload":...}`
`Some/Ok/Err`	`{"option":"Some","value":...}` etc.

A schema written for the natural object shape (e.g. `{"type":"object","properties":{"name":...}}`) will FAIL validation against a record return. The gate is most useful for primitive return types (`Int`, `String`, `Bool`) and homogeneous `List`/`Map` containers. Record/enum projection lands in a future sprint. Documented in design doc, doc comment, CHANGELOG.

Tests

• 11 new MCP tests (passthrough, valid, invalid w/ path errors, invalid w/ multiple errors, malformed schema, runtime-error-takes-precedence, empty-schema-accepts, $schema-non-2020-12-rejected, $schema-2020-12-accepted, size-limit, total_errors-field-present, wrapper-format-anchor)
• All 591+ existing workspace tests pass
• clippy clean, fmt clean

Review

`ce-correctness-reviewer` surfaced 1 HIGH + 3 MEDIUM findings. All addressed before commit:

#	Finding	Fix
1 (HIGH)	`validator_for` honored older drafts via `$schema`	REJECT non-2020-12 `$schema` at parse time
2 (MED)	`format_value` wrapper-format limitation	Documented loudly (design doc + doc comment + CHANGELOG + this PR)
3 (MED)	Unbounded errors array	Cap at 100 + `truncated` / `total_errors` fields
4 (MED)	No size limit on `output_schema`	256 KB cap before compilation

Security

`jsonschema = "0.30"` added with `default-features = false` — no `resolve-http` or `resolve-file` features, so `$ref` to remote URLs or local files cannot trigger SSRF or arbitrary file reads.

What's NOT in this PR (follow-ups)

• The user-facing `docs/reference/mcp-server.md` update for `output_schema` and new error kinds. Lives on PR MCP surface stabilization: tool reference docs + protocol_version: 1 (closes #6) #11's branch which adds that file; this PR is branched off master. Folds in as a small follow-up after PR MCP surface stabilization: tool reference docs + protocol_version: 1 (closes #6) #11 merges.
• Logical projection of Record/Enum to by-name JSON before validation. Future sprint when there's a real customer ask.
• Schema compilation caching. Defer until measured.

Closes

• Closes [P2] Output schema validation as a first-class gate #8 (FleetQ P2: output schema validation as a first-class gate)

FleetQ status after this PR

4 of 9 P1/P2 asks closed (#3, #5, #6, #8). Only 2 P2 asks remain:

• [P2] Record/replay for net.fetch #7 — Record/replay for net.fetch
• [P2] Per-call observability hooks (OpenTelemetry) #9 — Per-call OpenTelemetry observability

After those, only the 0.3.0 critical-path work (persistent state + dependent sprints) remains as the dominant roadmap focus.

🤖 Generated with Claude Code