feat(ai-hook): enforce MCP permissions natively

[amascia-gg]

Stacked on #1392. Addresses @clement-tourriere's comment there: "org denies mcp__github__delete_repository, the args have no secret, multiscan is clean, we allow. IMO this needs to be implemented, not skipped."

What it does

The native hook now asks both questions an MCP tool call raises, not one:

• the arguments, via /v1/multiscan — already there;
• the call itself, via POST /v1/agent-activity/mcp-activity — new. A {"allowed": false, "reason": ...} blocks with that reason; the scan verdict wins per payload, in payload order, as in _scan_payloads(). A failed request still allows, matching mcp.py.

MCP telemetry therefore reaches the dashboard again.

Why the discovery walk is not ported

parse_mcp_activity needs only ai_config.user and ai_config.servers, and both already sit in the ai_discovery.json that Python writes with a one hour TTL. So the ~2,700-line walk stays in Python and the new ggshield-discovery crate just reads what it left: the inventory, its freshness check (same TTL and skew tolerance as cache.py), and the per-agent server-name resolution.

With a stale or absent inventory the event is declined to ggshield-py via the existing Outcome::Delegate, which walks, submits and rewrites the file — so the next hour runs natively. Never allowed: failing open there would let anyone lift an administrator's block by deleting a cache file. Fail-open stays correct only for a failed request.

Full native discovery is future work, behind the crate boundary — ggshield ai discover, the history backfill and agent activity all read the same file.

Notes

• Vibe MCP detection lands with the separate Vibe work; any payload already classified as Tool::Mcp flows through this path whatever the agent.
• The freshness check moved ahead of the payload debounce: handing over replays the same stdin, and a debounce entry we had already written would make ggshield-py exit 0 with no verdict.

Verification

cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test --workspace (138 tests) all clean. The equivalence harness prints RESULT: EQUIVALENT, now including a new mcp matrix — 5 agents x {permitted, denied}, comparing the verdict and the activity report body, which is what proves the server name each dialect resolves to is the same on both sides.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.98%. Comparing base (3f2c3a2) to head (4bfdbdc).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1405   +/-   ##
=======================================
  Coverage   93.98%   93.98%           
=======================================
  Files         200      200           
  Lines       12638    12638           
=======================================
  Hits        11878    11878           
  Misses        760      760           

Flag	Coverage Δ
unittests	93.98% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.