com.scopeblind/protect-mcp

Fail-closed Cedar policy gate + Ed25519 signed receipts for agent tool calls.