fix(mcp): land ok_untag truthful-removal on main (PR #39 merge-plumbing recovery)

[andrei-hasna]

What this is

A merge-plumbing recovery, not new work. The code here is exactly PR #39, already
adversarially reviewed and approved in
#39 (comment). No source change has been
made since that review.

Why it is needed

PR #39 was stacked on PR #38 (base: fix/hc-00151-regenerate-mcp-bundle). #38 was merged to
main first, in the correct order — but GitHub did not retarget #39's base to main when its
parent merged, and I merged #39 without re-checking the base. So #39 merged into the
already-merged parent branch instead of into main:

gh pr view 39 --json baseRefName,mergeCommit,state
  base=fix/hc-00151-regenerate-mcp-bundle  mergeCommit=e3fd4ad  state=MERGED

git show 1b8e127:src/mcp.js | grep -c "No matching tag on"
  0      <-- the ok_untag fix was NOT on main

My error, recorded here rather than quietly re-pushed. The lesson for the next stacked pair:
after merging the parent, explicitly retarget the child's base to main and re-read it before
merging — a stacked child's base does not follow its parent automatically.

Why this branch is the right thing to merge

Nothing was lost and nothing extra is carried. e3fd4ad is main plus PR #39's three files and
nothing else:

git diff --stat 1b8e127 e3fd4ad
 bin/knowledge-mcp.js |  33 ++++++++++--
 src/mcp.js           |  67 ++++++++++++++++++++++--
 tests/mcp.test.ts    | 143 +++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 233 insertions(+), 10 deletions(-)

git show e3fd4ad:.github/workflows/ci.yml | grep -c 'bun-version: 1.3.14'   -> 2
git show e3fd4ad:src/mcp.js | grep -c 'No matching tag on'                  -> 1

So it carries both #38's merged state (including the CI bun pin fix) and #39's ok_untag fix,
with no duplicated or reverted content.

The change itself (unchanged from #39)

ok_untag returned ok: true, removed: 0 when it matched nothing, and called store.update
before any check so a no-op still bumped updated_at. Three defects fixed, ported from
untag in src/cli.ts so the two surfaces agree. Re-verified by me against the committed blob:

my mutation	rc	result
baseline, unmutated	0	2 pass 0 fail
delete the removed === 0 guard	1	1 pass 1 fail
move store.update before the guard	1	1 pass 1 fail
drop the whole-value continue	1	1 pass 1 fail

The legitimate re-run still succeeds — only a true no-op errors, matching the CLI's documented
exits 1 if nothing removed:

k_rerun = ["a,b,c","a","b","c"]
  untag ["a,b,c"] -> removed 1, ok
  untag ["a,b,c"] -> removed 3, ok     <-- idempotent re-run SUCCEEDS
  untag ["a,b,c"] -> isError           <-- only the true no-op errors

bun run verify:generated at this content: rc=0, 6 bundles byte-identical.
Full suite: 269 pass / 2 skip / 1 fail, sole failure the pre-existing
context pack and proposal context commands return bounded agent JSON, red on main too.

Tasks 68fc5c1c (the fix) and 20803062 (the parent).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}