feat(mcp): security hardening — command allowlist and env var validation

[bug-ops]

Summary

• Validate MCP server commands against configurable allowlist before spawning child processes (default: npx, uvx, node, python3, python, docker, deno, bun; extendable via mcp.allowed_commands)
• Block 21 dangerous environment variables (LD_PRELOAD, DYLD_, NODE_OPTIONS, PYTHONPATH, JAVA_TOOL_OPTIONS, etc.) and BASH_FUNC_ prefix from MCP server processes
• Reject commands containing path separators to prevent symlink-based bypasses

Closes #623, closes #651, closes #652

Changes

• New crates/zeph-mcp/src/security.rs with validate_command() and validate_env()
• New McpError::CommandNotAllowed and McpError::EnvVarBlocked variants
• McpClient::connect() validates command and env before Command::new()
• McpManager::new() accepts allowed_commands from config

Test plan

• 111 zeph-mcp tests pass (including 20 new security validation tests)
• 2045 workspace tests pass
• clippy zero warnings, fmt clean
• Default allowlist permits standard MCP runtimes
• Path separators rejected (no symlink bypass)
• All 21 blocked env vars individually tested
• BASH_FUNC_* prefix injection blocked