fix(mcp): surface MCP tools that register after the tool snapshot locks (#206)

MCP servers connect on a background tokio::spawn and register mcp__* tools
seconds after the session starts, typically after the first turn has already
locked the tool snapshot via tool_definitions(). The locked snapshot was then
reused forever, so the model never saw any MCP tools. The only unlock path
fired when the model called the 'mcp' management tool, which it could not do
without first seeing MCP tools, making the race unrecoverable.

tool_definitions() now detects when the registry contains mcp__* tools (subject
to the session allowed_tools/disabled_tools filters) that are missing from the
locked snapshot, and rebuilds + re-locks once. This costs exactly one provider
prompt-cache miss per session (the turn MCP tools first appear) and is stable
thereafter. Non-MCP registry changes still never invalidate the snapshot, so
cache stability is preserved.

Adds regression tests: late mcp__* tool becomes visible and the snapshot stays
stable afterwards, plus a guard that non-MCP registrations don't invalidate or
leak into the locked snapshot.