fix(mcp-proxy): record pre-approval deny evidence

[oleg-bk]

Summary

• persist terminal blocked evidence for unknown-tool denies before approval
• persist terminal blocked evidence for schema-deny invalid arguments before approval
• keep JSON-RPC deny responses unchanged while adding evidence records

Scope

• In scope: MCP Proxy passthrough pre-classification deny evidence and focused passthrough tests.
• Out of scope: approval retry loop implementation, git/fetch policy, filesystem path rules, TrapDoor expansion, backend/private/control-plane/secrets, release/version bump.
• Public/private boundary: public SDK MCP Proxy package only; no backend/private logic added.

Product-Path Acceptance

• Product-path gate: pass
• Artifact fingerprint: branch codex/mcp-proxy-preapproval-deny-evidence, commit ad1577b, base aabc009
• Positive path: not applicable; this is deny-evidence behavior.
• Negative path: unknown tool and schema-invalid calls deny before approval with no approval URL/pending approval.
• Evidence path: each covered deny writes exactly one terminal blocked evidence record with reason/status/count assertions.
• Old-state / migration behavior: old evidence DB chain recovery not touched; remains a separate issue.
• Remaining unverified: live Console retest against combined Dev A + Dev B artifact.

Type-specific gate:

• Evidence path: record/event status + reason + count + privacy check
• Hard deny path: blocked -> no approval URL / pending approval -> target not reached

Validation

• PYTHONPATH=../..:. python3 -m pytest tests/test_mcp_proxy_passthrough.py::test_unknown_tool_hard_deny_writes_terminal_blocked_evidence tests/test_mcp_proxy_passthrough.py::test_schema_deny_writes_terminal_blocked_evidence -q -> 2 passed
• PYTHONPATH=../..:. python3 -m pytest tests/test_mcp_proxy_passthrough.py tests/test_mcp_proxy_tool_surface.py tests/test_mcp_proxy_evidence.py tests/test_mcp_proxy_passthrough_concurrent.py -q -> 142 passed, 1 skipped
• After rebase onto aabc009: PYTHONPATH=../..:. python3 -m pytest tests/test_mcp_proxy_passthrough.py::test_unknown_tool_hard_deny_writes_terminal_blocked_evidence tests/test_mcp_proxy_passthrough.py::test_schema_deny_writes_terminal_blocked_evidence -q -> 2 passed
• CI: initial matrix passed after rerunning one macOS 3.11 flaky concurrency timeout; post-rebase CI pending.
• git diff --check / git diff --cached --check -> passed

Release / Claim Notes

• Claims this PR supports: unknown-tool and schema-deny paths now create terminal blocked evidence records on the covered local product path.
• Claims this PR does not support: old evidence DB chain recovery, release readiness by itself.

Implemented with assistance from Codex.