feat: let an agent ask what its connectors are, instead of guessing

An agent that wanted to know which MCP servers it had called
`list_mcp_servers` — a tool that has never existed anywhere in this
repo — and got "unknown tool". It was not a random hallucination: the
prompt block says "the system prompt shows available servers", and
`render_mcp_list` returned an empty string when nothing was connected.
The model read a promise, found no table, and invented the discovery
tool the text implied. The `mcp` kinds of `list_items`/`toggle_item`
had been removed to close the §14 RCE vector, which was right for the
write half and left no read half at all.

So `list_items` gains `type: "mcp"` and returns the whole picture in
one call, split into four buckets that each answer a different
question: what is already loaded (call its tools directly), what is
ready for `activate_tools`, what is installed but unusable and why,
and what the user could still activate. Conflating the first two is
what produced the original failure, so they stay apart. Every entry
carries a derived note and a next step; when the step is a human one,
it says so and names the UI page, because there is no tool for it.

Read-only, and structurally so: `toggle_item` deliberately gains
nothing, and the new `McpDirectory` trait exposes exactly one method.
Enabling a connector from a tool is the thing §14 removed, and a wider
seam here is how it would come back. Deny-by-default survives the
report — an ungranted connector is not named at all, since a listing
of what to ask for is itself a leak — except for a catalogue manager,
who cannot administer what they cannot see.

Three sources answer three questions and none is redundant: the
registry says what exists and who may have it, the owner database says
what was activated, and the live runtimes say what is connected right
now — a row can read `ready` while its process is dead. The live half
reaches the tool through the turn's extension map, alongside the pool
and the fs view; with no live view the durable picture still renders,
so freshness is an improvement and never a precondition.

The static `__MCP_LIST__` table stays as it was, because it is frozen
per conversation for prompt-cache stability. Its empty case now says
so out loud and points at the tool.

crates/skald-core/src/mcp/mod.rs

@@ -32,7 +32,7 @@ pub mod verify;
 
 pub use install::{CONNECTORS_DIR, MANIFEST_FILE, connector_dir, ensure_installed_host, install_into_home, split_script_path};
 pub use oauth::DeliverSpec;
-pub use provider::{McpProvider, SharedGlobalAccess, UserMcpView};
+pub use provider::{McpDirectoryHandle, McpProvider, SharedGlobalAccess, UserMcpView};
 pub use verify::{VerifyReport, VerifyTarget, apply_placeholders, run_verify};
 
 const SERVER_START_TIMEOUT_SECS: u64 = 120;

crates/skald-core/src/mcp/provider.rs

@@ -148,3 +148,32 @@ impl McpProvider for UserMcpView {
         }
     }
 }
+
+/// Adapts any [`McpProvider`] to the tool layer's read-only
+/// [`McpDirectory`](core_api::tool::McpDirectory) window.
+///
+/// A newtype rather than an impl on the trait object because the two traits live
+/// in different crates and only one of them may know about the other: `core-api`
+/// must not learn what an `McpManager` is.
+pub struct McpDirectoryHandle(pub Arc<dyn McpProvider>);
+
+impl core_api::tool::McpDirectory for McpDirectoryHandle {
+    fn connected(&self) -> Vec<core_api::tool::McpServerView> {
+        let descriptions = self.0.server_descriptions();
+        // Group the flat tool list by server. BTreeMap so the report is stable
+        // across calls — a model re-reading it should not see things move.
+        let mut by_server: std::collections::BTreeMap<String, Vec<String>> =
+            descriptions.keys().map(|n| (n.clone(), Vec::new())).collect();
+        for t in self.0.tools() {
+            by_server.entry(t.server_name).or_default().push(t.name);
+        }
+        by_server
+            .into_iter()
+            .map(|(name, tools)| core_api::tool::McpServerView {
+                description: descriptions.get(&name).cloned().flatten(),
+                name,
+                tools,
+            })
+            .collect()
+    }
+}