fix(discovery): authorize exact-name GossipSub tool results

[rhein1]

Summary

Addresses the exact-name discovery gap in #176.

The GossipSub fast path previously returned ServiceAnnounce rows directly. Announcements are useful routing hints, but they do not prove that the current caller is authorized to access the advertised MCP service.

This change:

• treats exact-name GossipSub rows as candidates rather than final results
• verifies each candidate through the existing authenticated MCP session
• confirms the exact tool is present in tools/list before returning it
• omits authorization, connection, malformed-peer, timeout, and missing-tool failures
• preserves candidate order and operator-declared routing labels
• falls back to the existing catalog discovery path when no gossip candidate verifies
• limits verification to eight workers and one shared five-second window
• reuses the same description helper as describe_remote_tool

There is no dependency, wire-format, or policy-model change.

Regression coverage

The new test advertises two services on the same peer with the same tool name. The caller's Biscuit authorizes one service and denies the other. Only the authenticated service is returned, with its description populated from the verified MCP session.

Validation

go test -race ./internal/node -run TestVerifyGossipToolRows_AuthenticatesEachServiceOnSamePeer -count=1
go test ./internal/node -count=1

Both pass.

I also ran go test ./... -count=1 in an unprivileged Go 1.25.7 container. The changed package and neighboring packages passed. The repository-wide command remained red on two environment-specific checks outside this patch: the Windows-copied embedded skill fixture retained CRLF, and TestSamBoxNanoInitIntegration could not call unshare in the unprivileged container.

[gemini-code-assist]

Code Review

This pull request introduces verification for gossip tool rows in the MCP handlers. Unsolicited announcements are now treated as routing hints and verified through authenticated MCP sessions using the new verifyGossipToolRows and fetchRemoteToolDescription methods. A comprehensive unit test has been added to ensure correct authentication and label preservation. The review feedback suggests a minor optimization to return early from verifyGossipToolRows if the candidates slice is empty, avoiding unnecessary resource allocation and goroutine overhead.

[rhein1]

@aojea This is ready for maintainer review. It closes the exact-name GossipSub authorization gap in #176 by treating announcements as candidates and confirming each through an authenticated service-specific MCP tools/list; unauthorized, malformed, missing, and timed-out candidates are omitted. Current signed head: 7a57715d. All hosted checks are green, including CLA, test, lint, govulncheck, and e2e; the focused regression covers allowed and denied services advertised by the same peer.

[aojea]

Thanks