Codex findings on main's MCP code mode and ACP resume (raised on #329) #347

Codex's review of #329 (head bcd6b1b) raised five findings in code that is already on main and outside that PR's diff (sonny/src/mcp.rs, sonny/src/exec.rs, sonny/src/acp.rs). Logged here so they're not lost. Full text: #329 (comment)

• P1, mcp.rs ~L342. The MCP server fingerprint is the config's debug string, so it holds the literal values from env and http_headers. Hub::keep writes it to ~/.agent/sonny/mcp/<server>.json with default permissions. Use a digest and restrict the cache file's mode.
• P1, exec.rs ~L743. Script output from text() is collected in a Rust vector that QuickJS's memory limit doesn't count, and max_output_tokens is only applied after the run. One script can grow the lookout's memory without bound. Bound it while collecting.
• P2, exec.rs ~L482. MCP discovery (hub.tools()) runs before the exec deadline is set, so a slow server can make a timeout_ms: 1000 call take tens of seconds. Set one deadline before admission and discovery.
• P1, acp.rs ~L299. Resuming an ACP thread binds by bot name only (t3::remember). A deleted and re-created bot with the same name, or a different --store, gets attached silently. Persist the store and bot_id and refuse a mismatch.
• P2, exec.rs ~L469. Normalized MCP tool identifiers can collide (my-server and my_server both give mcp__my_server__search), and the later one silently replaces the earlier. Refuse the collision.