feat: configurable exposure policy for direct, indirect and disabled tools

Introduces ExposurePolicy (option lit_mcp_exposure) deciding per ability
whether it is a direct MCP tool, only reachable via mcp-adapter's
execute-ability meta-tool, or disabled entirely (not registered with the
Abilities API at all). Ability::isDirect() remains the default when no
override applies. lit/guide can never be disabled or made indirect;
lit/media-preview and lit/media-download (image/embedded-resource results)
can never be made indirect, only direct or disabled.

AbilityRegistrar and ServerRegistrar take an optional ExposurePolicy and
use it to filter registered abilities / compute the direct tool list.
IntegrationRegistry::directAbilityNames() is removed (superseded by
ExposurePolicy::directNames()). InstructionsBuilder now also takes the
policy and lists the currently direct tools by name (lit-<name>), noting
the rest are reachable via mcp-adapter-execute-ability as lit/<name>.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Guides/InstructionsBuilderTest.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Tests\Unit\Guides;
 
+use LIT\MCP\Abilities\Ability;
+use LIT\MCP\Abilities\ExposurePolicy;
 use LIT\MCP\Guides\InstructionsBuilder;
 use LIT\MCP\Integrations\Integration;
 use LIT\MCP\Integrations\IntegrationRegistry;
@@ -12,11 +14,28 @@ use Mockery;
 
 final class InstructionsBuilderTest extends TestCase
 {
-    public function testNamesActiveIntegrationsAndCoreRules(): void
+    private function ability(string $name, bool $direct): Ability
+    {
+        $ability = Mockery::mock(Ability::class);
+        $ability->allows('name')->andReturn($name);
+        $ability->allows('isDirect')->andReturn($direct);
+
+        return $ability;
+    }
+
+    private function coreWith(Ability ...$abilities): Integration
     {
         $core = Mockery::mock(Integration::class);
         $core->allows('id')->andReturn('core');
         $core->allows('isAvailable')->andReturn(true);
+        $core->allows('abilities')->andReturn(array_values($abilities));
+
+        return $core;
+    }
+
+    public function testNamesActiveIntegrationsAndCoreRules(): void
+    {
+        $core = $this->coreWith($this->ability('lit/guide', true), $this->ability('lit/menu-list', false));
 
         $text = (new InstructionsBuilder(new IntegrationRegistry($core)))->build();
 
@@ -28,9 +47,7 @@ final class InstructionsBuilderTest extends TestCase
 
     public function testListsPostTypesWhenAProviderIsGiven(): void
     {
-        $core = Mockery::mock(Integration::class);
-        $core->allows('id')->andReturn('core');
-        $core->allows('isAvailable')->andReturn(true);
+        $core = $this->coreWith($this->ability('lit/guide', true));
 
         $text = (new InstructionsBuilder(new IntegrationRegistry($core), static fn (): array => ['page', 'post']))->build();
 
@@ -38,4 +55,31 @@ final class InstructionsBuilderTest extends TestCase
         self::assertStringContainsString('lit-content-types', $text);
         self::assertStringContainsString('confirm: true', $text);
     }
+
+    public function testListsTheCurrentlyDirectToolsByToolNameAndNamesTheRestNeutrally(): void
+    {
+        $core = $this->coreWith(
+            $this->ability('lit/guide', true),
+            $this->ability('lit/menu-list', false)
+        );
+
+        $text = (new InstructionsBuilder(new IntegrationRegistry($core)))->build();
+
+        self::assertStringContainsString('Direkt aufrufbare Tools: lit-guide', $text);
+        self::assertStringContainsString('mcp-adapter-execute-ability', $text);
+        self::assertStringNotContainsString('lit-menu-list', $text);
+    }
+
+    public function testDirectToolListReflectsExposurePolicyOverrides(): void
+    {
+        $core = $this->coreWith(
+            $this->ability('lit/guide', true),
+            $this->ability('lit/menu-list', false)
+        );
+        $policy = new ExposurePolicy(['lit/menu-list' => 'direct']);
+
+        $text = (new InstructionsBuilder(new IntegrationRegistry($core), null, $policy))->build();
+
+        self::assertStringContainsString('lit-menu-list', $text);
+    }
 }