feat: let an agent ask what its connectors are, instead of guessing

An agent that wanted to know which MCP servers it had called
`list_mcp_servers` — a tool that has never existed anywhere in this
repo — and got "unknown tool". It was not a random hallucination: the
prompt block says "the system prompt shows available servers", and
`render_mcp_list` returned an empty string when nothing was connected.
The model read a promise, found no table, and invented the discovery
tool the text implied. The `mcp` kinds of `list_items`/`toggle_item`
had been removed to close the §14 RCE vector, which was right for the
write half and left no read half at all.

So `list_items` gains `type: "mcp"` and returns the whole picture in
one call, split into four buckets that each answer a different
question: what is already loaded (call its tools directly), what is
ready for `activate_tools`, what is installed but unusable and why,
and what the user could still activate. Conflating the first two is
what produced the original failure, so they stay apart. Every entry
carries a derived note and a next step; when the step is a human one,
it says so and names the UI page, because there is no tool for it.

Read-only, and structurally so: `toggle_item` deliberately gains
nothing, and the new `McpDirectory` trait exposes exactly one method.
Enabling a connector from a tool is the thing §14 removed, and a wider
seam here is how it would come back. Deny-by-default survives the
report — an ungranted connector is not named at all, since a listing
of what to ask for is itself a leak — except for a catalogue manager,
who cannot administer what they cannot see.

Three sources answer three questions and none is redundant: the
registry says what exists and who may have it, the owner database says
what was activated, and the live runtimes say what is connected right
now — a row can read `ready` while its process is dead. The live half
reaches the tool through the turn's extension map, alongside the pool
and the fs view; with no live view the durable picture still renders,
so freshness is an improvement and never a precondition.

The static `__MCP_LIST__` table stays as it was, because it is frozen
per conversation for prompt-cache stability. Its empty case now says
so out loud and points at the tool.

crates/skald-core/src/skald/bundles.rs

@@ -218,11 +218,15 @@ impl Tools {
         tool_registry.register(crate::tools::ast_outline::AstOutline::new());
         tool_registry.register(crate::tools::exec::ExecuteCmd);
         tool_registry.register(crate::tools::read_notification::ReadNotification);
-        // Unified listing / toggling across plugins, cron (+ agents for list). MCP
-        // is no longer agent-managed (blueprint §14): connectors are curated by the
-        // admin and activated by the user via the Connectors UI/API, not tools.
+        // Unified listing / toggling across plugins, cron (+ agents and MCP for
+        // list). MCP is listed but never agent-*managed* (blueprint §14):
+        // connectors are curated by the admin and activated by the user via the
+        // Connectors UI/API — hence `list_items` gained the type and
+        // `toggle_item` deliberately did not.
         tool_registry.register(crate::tools::list_items::ListItems::new(
-            Arc::clone(&integrations.plugin_manager), Arc::clone(&tasks.cron)));
+            Arc::clone(&integrations.plugin_manager),
+            Arc::clone(&tasks.cron),
+            Arc::clone(&rt.db)));
         tool_registry.register(crate::tools::toggle_item::ToggleItem::new(
             Arc::clone(&integrations.plugin_manager), Arc::clone(&tasks.cron)));
         tool_registry.register(crate::tools::cron_jobs::DeleteCronJob);