Add mlr mcp MCP server + agent playbook, with a --no-shell gate (#2098 PR7) (#2133)

* Plan: flesh out PR7 (MCP server + Agent Skill) design

stdio transport (no HTTP port), mlr mcp terminal in the main binary,
SDK-vs-handroll decision, tool list, in-process vs subprocess split,
run-tool safety (--no-shell prerequisite), single-sourced skill, tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Add mlr mcp: MCP server + agent playbook; --no-shell gate (#2098 PR7)

New terminal `mlr mcp` runs a Model Context Protocol server over stdio
(spawned by MCP clients; no network port), exposing five tools --
list_capabilities, which, validate_dsl, describe_data, run -- plus an
agent playbook as MCP prompt/resource. Catalog tools are served
in-process from the help registries; the rest subprocess this same
binary with MLR_ERRORS_JSON=1, a timeout, and an output cap.

Prerequisite: a new --no-shell flag / MLR_NO_SHELL env var (one-way
gate) disables the DSL system/exec functions, piped redirects, and
--prepipe/--prepipex; the MCP server sets it on the commands it runs
unless started with --allow-shell.

Adds the github.com/modelcontextprotocol/go-sdk dependency.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Force LF checkout for the embedded SKILL.md (Windows CI fix)

go:embed embeds checkout bytes, so a CRLF checkout on Windows made the
embedded playbook differ per platform and failed
TestPlaybookHasFrontmatter. Pin the file to eol=lf in .gitattributes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Move no-shell test DSL into per-case mlr files (Windows CI fix)

Inline single-quoted DSL in cmd files is mangled by the Windows shell
(single quotes are not quote characters there); the harness's
put -f ${CASEDIR}/mlr pattern avoids shell quoting entirely.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

pkg/lib/halfpipe.go

@@ -20,6 +20,9 @@ import (
 // free.
 
 func OpenOutboundHalfPipe(commandString string) (*os.File, error) {
+	if !shellOutEnabled {
+		return nil, fmt.Errorf("piped redirects are disabled by --no-shell / MLR_NO_SHELL")
+	}
 	readPipe, writePipe, err := os.Pipe()
 	if err != nil {
 		return nil, err
@@ -58,6 +61,9 @@ func OpenOutboundHalfPipe(commandString string) (*os.File, error) {
 // free.
 
 func OpenInboundHalfPipe(commandString string) (*os.File, error) {
+	if !shellOutEnabled {
+		return nil, fmt.Errorf("--prepipe/--prepipex are disabled by --no-shell / MLR_NO_SHELL")
+	}
 	readPipe, writePipe, err := os.Pipe()
 	if err != nil {
 		return nil, err

pkg/lib/shell_gate.go

@@ -0,0 +1,39 @@
+// Package-level gate for shell-outs, controlled by the --no-shell main flag
+// or a truthy MLR_NO_SHELL environment variable.
+//
+// When disabled, every place Miller can execute an external command in the
+// data path -- the DSL system() and exec() functions, piped output redirects
+// (e.g. `tee | "command"`), and --prepipe/--prepipex -- fails cleanly instead
+// of running the command. This exists so that automation driving Miller (in
+// particular the `mlr mcp` server, which sets MLR_NO_SHELL on the subprocesses
+// it spawns) can run agent-constructed command lines without also granting
+// arbitrary command execution.
+//
+// The gate is one-way by design: it can be disabled during startup, but never
+// re-enabled, so an argv-injected flag cannot override an environment-level
+// opt-out.
+
+package lib
+
+var shellOutEnabled = true
+
+// DisableShellOut turns off all shell-out capability for the remainder of the
+// process lifetime.
+func DisableShellOut() {
+	shellOutEnabled = false
+}
+
+// ShellOutEnabled reports whether shell-outs are permitted.
+func ShellOutEnabled() bool {
+	return shellOutEnabled
+}
+
+// IsTruthyEnvValue returns true for non-empty strings commonly used as
+// boolean env-var truthy values: "1", "true", "yes" (case-insensitive).
+func IsTruthyEnvValue(v string) bool {
+	switch v {
+	case "1", "true", "True", "TRUE", "yes", "Yes", "YES":
+		return true
+	}
+	return false
+}