merge: tool groups with inherited mode and 'nur lesen' per group

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/Unit/Server/ServerRegistrarTest.php

@@ -32,6 +32,7 @@ final class ServerRegistrarTest extends TestCase
         $indirect = Mockery::mock(Ability::class);
         $indirect->allows('name')->andReturn('lit/rare-tool');
         $indirect->allows('isDirect')->andReturn(false);
+        $indirect->allows('annotations')->andReturn([]);
 
         $core = Mockery::mock(Integration::class);
         $core->allows('id')->andReturn('core');
@@ -89,6 +90,24 @@ final class ServerRegistrarTest extends TestCase
         );
     }
 
+    public function testGroupSettingsReachTheToolListAndTheInstructions(): void
+    {
+        $registry = $this->registry();
+        $policy = (new ExposurePolicy(['@group:core' => 'disabled', '@readonly:core' => true]))
+            ->withGroups($registry->groupMap());
+        $instructions = new InstructionsBuilder($registry, null, $policy);
+
+        $args = (new ServerRegistrar($registry, $instructions, static fn () => true, null, null, $policy))
+            ->serverArguments();
+
+        // lit/guide is REQUIRED and stays direct; lit/rare-tool is disabled by the group.
+        self::assertSame(
+            ['lit/guide', 'mcp-adapter/discover-abilities', 'mcp-adapter/get-ability-info', 'mcp-adapter/execute-ability'],
+            $args['tools']
+        );
+        self::assertStringContainsString('Direkt aufrufbare Tools: lit-guide.', $args['description']);
+    }
+
     public function testNoServerWhenOauthIsDisabled(): void
     {
         $registrar = new ServerRegistrar($this->registry(), $this->instructions(), static fn () => false);