Tighten MCP tool contracts

[Widthdom]

Summary

• Lock down MCP tool schemas with additionalProperties: false and reject unknown tools/call arguments, including nested batch_query slots.
• Add MCP x-stability markers and mark experimental tools in tools/list.
• Align manually assembled MCP structured payload fields with snake_case where this PR touches SQL/exact signal payloads and related descriptions.

Validation

• dotnet build
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~McpServerTests.ToolsList_EveryInputSchemaRejectsAdditionalPropertiesAndPublishesStability|FullyQualifiedName~McpServerTests.ToolsCall_UnknownArgument_ReturnsInvalidParams|FullyQualifiedName~McpServerTests.ToolsList_CallersCalleesAnalyzeSymbolDescriptions_PinSnakeCaseMixedKindFields|FullyQualifiedName~McpServerTests.ToolsCall_ExactAliases_RejectsCombinedFlags|FullyQualifiedName~McpServerTests.ToolsCall_Search_RejectsExactNameAlias|FullyQualifiedName~McpServerTests.ToolsCall_Symbols_RejectsExactSubstringAlias|FullyQualifiedName~McpServerTests.ToolsCall_Search_RejectsFalseExactNameAlias|FullyQualifiedName~McpServerTests.ToolsCall_Symbols_RejectsFalseExactSubstringAlias|FullyQualifiedName~McpServerTests.ToolsCall_ImpactAnalysis_CountOnly_OmitsCallerRows"

Docs / Changelog

• Updated README.md and DEVELOPER_GUIDE.md.
• Added changelog fragments:
  • changelog.d/unreleased/1696.added.md
  • changelog.d/unreleased/1723.changed.md
  • changelog.d/unreleased/1778.fixed.md

Review

• codex exec adversarial review was attempted but blocked by the Codex usage limit.
• Manual adversarial review of origin/main..HEAD found and fixed the missing batch_query unknown-argument validation path.

Notes

• Full McpServerTests was not used as final validation because local Git commit signing prompts for /Users/widthdom/.ssh/id_ed25519_signing in temp-repo tests. Targeted MCP tests above passed on both net8.0 and net9.0.

Fixes #1778
Fixes #1723
Fixes #1696