Save the agent's MCP settings

Replaces the agent's whole settings row in one transaction and makes no release: a new session reads it at once, a change that narrows reaches running sessions too, and a change that widens only sessions that start after it. expected_revision is settings_revision as read (null when there was no row); another value answers 409 REVISION_CONFLICT. updated_by is always the caller, so the first person's save of an agent also fixes the rollback floor at the snapshot-reading image. A server the save adds must be in the catalog (400 server_unknown; server_builtin for the built-in one); every allowed_tools name must be mcp__<server>__<tool> of the chosen server (tool_outside_server; the name has no spaces or control characters and is at most 128 characters), a tool the save adds that the workspace's or the agent's rules block is refused (mcp_tool_denied; a tool the row already holds can still be narrowed away), with no server there are none (server_required), and the server's credential name must be in credential_refs (server_credential_missing). A repeated tool or credential name is refused (duplicate). Binding the credentials is not required to save. Writes a set_agent_mcp receipt with result.change = "settings" and the names before and after; receipt_id is null when a person's row already held them. Agent managers with a web session only; API keys are refused.

Auth: cookie session only; no scope. Idempotency-Key: ignored.