Complete external agent harness workflow

[epowell40]

What changed

• added machine-correct Codex and Claude Code MCP configuration generation
• added a live doctor and real child-process stdio smoke workflow
• added bounded pane-free once and session write grants with no YOLO option
• repaired public/private apps-layout discovery and canonicalized Codex MCP registration
• documented the supported external-host architecture and safety boundary
• extended MCP regression coverage through authenticated generic read/write calls

Why

The public bridge and MCP tools already existed, but external agent harnesses lacked a complete operational path: configuration was fragile, write approval depended on the Operator pane, and no reusable live stdio acceptance command existed.

Validation

• npm --prefix apps/mcp-server test — 21/21 passed
• operator backend build plus config tests — 2/2 passed
• dotnet build RevitBridge/RevitBridge.csproj -c Release -f net48 — passed, 0 errors (existing warnings)
• live external-agent doctor against Revit 2024 — ready
• live external-agent smoke — 113 tools, ping/search/context/grant status passed through an independent stdio child
• helper-issued one-time grant accepted by the live .NET bridge, then prior grant restored byte-for-byte
• visual Revit inspection — Snowdon L4 Power remained healthy and unchanged with no Operator pane involved