v2.3.0

Added

• MCP tool annotations for all 37 tools (per MCP spec + tool-design best
  practice): display title plus readOnlyHint/destructiveHint/
  idempotentHint/openWorldHint on every registration. 14 pure-read tools
  marked read-only/closed-world; cli_upgrade, session_delete,
  session_clear_all, llm_job_cancel marked destructive; every
  provider-spawning tool (requests, fork, validation) marked open-world with
  destructive potential (spawned agentic CLIs can modify the environment).
  Clients can use the hints for confirmation UX and safe auto-approval. New
  invariant test pins titles, the exact destructive/read-only/open-world
  sets, and the readOnly+destructive contradiction ban.