[acamarata]

Closes the five cli product gaps the P7-SHIP-02 MCP-only agent harness (#1029) stops at. Do not merge from here; the manager merges.

Changes

1. nself mcp without a project. The server starts anywhere. With no project it lists nself_init and the read-only tools; once a project exists it lists every tool.
2. First build is plan-bindable. A render that generates secrets gets a plan id its inputs reproduce: the content id of a second, read-only render with a fixed public seed. It is used only when both renders have the same plan; otherwise E451 still applies (fail closed). The plan declares secrets-persist; the apply draws fresh secrets and writes exactly its own render; input drift is still E450. The machine gate always returns a plan confirmation for a plan that declares secrets-persist, so the agent sees build (plan, then confirm).
3. Live tool list. mcpgen.Surface checks the project root and the installed plugin set after every successful call. When they changed, it rebuilds the machine registry and calls SetTools, which sends notifications/tools/list_changed. The ci tools then appear after add ci in the same session.
4. deploy promote <source> <target>. Use was promote [source target] (one arg); it is now two optional args, so ["qa","prod"] validates.
5. nself mcp --timeout (default 5m, minimum 1s) bounds each tool call; a longer call answers E423.

nself mcp now rejects positional args (cobra.NoArgs). The generated registry, inventory, OpenAPI, TS SDK types, MCP tool golden and wiki pages are regenerated. The hand docs describe the new behaviour.

Tests

• internal/reconcile: the binding id is the same for every seed; a plan id binds a first build; the written secrets are not the binding render's; drift gives E450; sameShape.
• internal/invoke: a write plan with secrets-persist returns a kind plan confirmation; parsePlan reads the secrets fact.
• internal/mcpgen: the no-project filter.
• cmd/commands: an stdio session with no project, then init, then a plugin added during the session, with tools/list_changed each time and none when nothing changed; the --timeout E423 bound and flag validation; deploy promote qa prod argv; the fresh-project build --plan-id round trip with E450 on drift.

Local evidence (CI host mm4): go test passed for reconcile, invoke, mcpgen, errs and repoqa, and for the scoped cmd/commands MCP/build/surface/registry/contract tests in both compat modes. make contract-check and make wiki-check passed. TestMCPIntegration_InitBuildVerify (V15) fails on mm4 with E128 from a stray ~/.nself/plugins/cron in that host's real HOME. It fails the same way on unmodified origin/main there, so this change did not cause it.