mcp: annotate every tool so a host can tell an observation from an input action

[xxx]

Fixes #509.

destructiveHint and openWorldHint both default to true in the MCP spec, so glass's 30 unannotated tools read to a host as destructive and open-world — glass_a11y_snapshot paid the same confirmation prompt as glass_click. Every tool now declares readOnlyHint and openWorldHint; every input tool also declares destructiveHint.

The four judgement calls the issue left open:

• glass_doctor is not read-only. deep = true spawns and tears down a headless display, and a hint is per-tool, not per-argument, so the worst case wins.
• glass_start is the only open-world tool. It builds, and a build fetches dependencies over the network. Everything else is bounded by the one local app.
• glass_stop is destructive, and idempotent — a second stop adds no further effect.
• idempotentHint is otherwise claimed only for glass_select_window. glass_move, glass_window, glass_set_value and glass_clipboard_set all look idempotent but fire app-visible events whose handlers run again on a repeat; claiming otherwise invites a host to auto-retry them.

glass_baseline_save and glass_select_window are read_only = false, destructive = false: they change glass's state, not the app's.

annotations_classify_every_tool holds an exhaustive name -> read_only table and checks that every tool carries annotations, that its classification matches the table, that openWorldHint is always set, that input tools set destructiveHint, and that read-only tools set neither destructiveHint nor idempotentHint (the spec says both are meaningless there). A tool added later fails until it is classified; a reclassification cannot be silent.

Verification

• All six guard branches ablated individually and confirmed red before the annotations went in.
• tools/list over stdio against the built binary returns 30 tools, none without annotations, in camelCase.
• cargo test --workspace (0 failures), cargo clippy --workspace --all-targets -- -D warnings, cargo fmt --all --check.

Draft until CI is green.