fix(hosted): bound MCP tool projection

[dajiaohuang]

Problem

SagaSmith Web enforces a 16-tool Hosted projection, but the Agent worker accepted up to 100 operations. That left model-selection quality dependent on upstream policy alone. The standard Hosted media and recoverable-error contracts also lacked complete response-level regression coverage. Workspace max-count was documented but did not atomically cap concurrent active workers.

Solution

• reject Hosted trusted contexts whose concrete allowed-operations projection exceeds 16
• retain exact-operation and call-time authorization checks
• verify real standard MCP text/audio/resource-link/embedded-resource serialization through the Hosted response
• verify audio and embedded image blocks produce Host media envelopes for Web artifact ingestion
• verify structured MCP tool errors remain HTTP 200 Hosted responses with isError, retryability, and recovery details intact
• enforce active-workspace admission under a root-scoped cross-process lock
• let retries and restarts with the same owner and canonical path reuse their slot; reject new or reactivated workspaces at the cap
• preserve unknown directories and active workspaces during marker-owned TTL/LRU cleanup
• document the tool and workspace boundaries in both READMEs and the Host adapter guide

Verification

• 223 passed, 2 skipped: Hosted apps, MCP wrapper/v2/tasks/reconnect/retry, and Host contract suites
• includes an independent-process race test for atomic workspace admission
• Ruff passed for all changed Python and test files
• git diff --check passed