feat(mcp): supply-chain audit declarations for MCP servers

[raymondginger2018-sudo]

Summary

Third-party components (Python modules, external datasets — and for a harness, remote MCP servers) can be compromised. This PR renders a declaration audit for a resolved MCP plan: for every server, what is being introduced (transport, source, command/URL), what capabilities it declares (tool count + names), and what policy constrains it.

Output designed for

(a) Human review before first use of a server
(b) Regression diff when a config changes — a newly appearing server/tool in the diff is a supply-chain event worth noticing
(c) Feeding the allowlist decision for MCP server approval

API

• ServerAuditEntry dataclass — one server's supply-chain declaration
• audit_mcp_plan(plan) -> MCPAuditReport — full report with diff support
• Pure mechanism — no network, no execution, no I/O

File

• core/mcp/audit.py (new, 177 lines)

Part of GenAI lesson 13 supply-chain security family.

[raymondginger2018-sudo]

设计说明

问题：MCP server 是从外部拉取的代码，运行在 agent 内部，可能有供应链风险（恶意或过时依赖、可疑的权限请求）。目前没有统一的审计声明格式。

解法：ServerAuditEntry dataclass + audit_mcp_plan()——为每个 MCP server 声明来源、版本、权限请求、风险等级，并批量审计整个 MCP 配置计划。

关键设计决策：

• 声明式而非扫描式——不试图静态分析二进制/依赖树（不可靠且昂贵），而是要求配置方显式声明来源与风险，审计函数负责校验一致性
• 风险等级用枚举约束（low/medium/high/critical），避免自由字符串
• 输出结构化报告，可被 CI 或启动前检查消费

注意：本文件引用了 core.mcp.naming 的辅助函数，合并时需要确保该模块在上游存在或稍作适配。

测试建议：构造一份含高危来源的 MCP 计划，验证审计报告正确标记