loobric-cli 1.4.1 — MCP SDK pin + field-session fixes

Fixes a startup crash on every fresh install: the MCP Python SDK released 2.0.0, removing the 1.x low-level Server API — the [mcp] extra is now pinned mcp>=1.0,<2, and environments already holding SDK 2.x get a one-line fix message instead of a traceback. uvx --from loobric-cli[mcp] loobric-mcp configs work again as-is.

Also in this release (lessons from the first setups-era field sessions):

• Fresh-sync disambiguation — an empty crib with a populated tool table now answers with both facts on the CLI (list-tools names each machine's entry count), the MCP tool description, and loobric://concepts, instead of a bare "no tools".
• Credential hygiene — new README section (agent workstations get a --preset agent key, never a shared session file) and a concepts-resource rule for agents: a bind/delete succeeding is the misconfiguration signal.
• loobric delete-key KEY [--yes] — permanently remove a revoked key (an active key must be revoked first; pairs with loobric-server 0.7.1's DELETE /auth/keys/{id}?purge=true).
• MCP machine_setup_status states the exact use-set MACHINE SET verb shape; set-related MCP descriptions caught up with 1.4.0's claims/setups vocabulary.

Full details in CHANGELOG.md.