Expose workspace capabilities to MCP - #57

Summary

• add the short Remote MCP tool capabilities to developer, readonly, and admin toolsets
• read the generated /etc/developer-workspace/capabilities.json directly from the selected workspace agent
• return available=false for legacy images that do not publish the manifest, including real HTTP 404 agent errors
• replace the generic MCP server text with static onboarding that tells assistants to inspect capabilities before installing software, without naming concrete packages
• keep the assistant-facing contract independent from future browser/database/tool additions
• track capabilities in safe tool activity metadata

Validation

• go vet ./codersdk/toolsdk ./coderd/mcp
• focused toolsdk/MCP unit tests, including filesystem and HTTP-404 legacy-image cases
• actionlint on the custom release workflow
• real MCP HTTP E2E compiles/starts locally but requires Docker-backed PostgreSQL; local workspace has no /var/run/docker.sock
• custom release CI explicitly runs TestMCPHTTP_E2E_UserToolsets on the GitHub runner to verify initialize instructions and ListTools over HTTP

Note: commit/pre-push hooks were bypassed only because the currently deployed Developer Workspace image has the legacy generic mise wrapper/worktree hook issue this change set is designed to remove; equivalent relevant gates were run explicitly.