feat(mcp): expose paper-named tools

[manzil-infinity180]

Closes #117.

Adds the four MCP tools the paper names in §3.3:

• aflock_authorize — alias of check_tool
• aflock_attest — alias of sign_attestation
• aflock_check_limits — new; returns {value, used, remaining, enforcement} per declared limit
• aflock_delegate — new; JWT-gated, validates sublayout + attenuation, writes propagation, mints an attenuated child JWT via auth.TokenIssuer.MintChildToken

check_tool and sign_attestation stay registered. AttenuationViolations moves from internal/hooks/handler.go to internal/policy/ so hooks and MCP share one rule.

api_key gating for aflock_check_limits is intentionally out of scope — will follow PR #127 once it lands.

Test plan

• go test ./... clean
• live MCP probe — all four names resolve and return well-formed JSON
• delegate happy path: propagation file written, child JWT carries sub.Limits.MaxSpendUSD and inherits parent MaxTokensIn
• delegate rejects unknown / attenuation-violating sublayout

[Copilot]

Pull request overview

This PR exposes the MCP tools named in the paper and adds delegation/limit-query support while sharing attenuation checks between hooks and MCP paths.

Changes:

• Registers aflock_authorize / aflock_attest aliases and adds aflock_check_limits / aflock_delegate.
• Adds child JWT minting for delegated sublayouts and tests for paper-named MCP tools.
• Moves attenuation checking into internal/policy and updates Go module metadata.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
internal/mcp/server.go	Registers paper-named tools and implements limit checking and delegation handlers.
internal/mcp/handlers_paper_tools_test.go	Adds tests for limit responses, delegation behavior, and tool registration.
internal/auth/jwt.go	Adds child-token minting and limit merging for delegated sublayouts.
internal/auth/jwt_test.go	Tests child token limit merging and nil argument errors.
internal/policy/attenuation.go	Adds shared attenuation validation helper.
internal/hooks/handler.go	Replaces local attenuation helper with shared policy helper.
go.mod	Updates Go version and dependency classification.
go.sum	Tidies dependency checksums.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 3 comments.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 2 comments.