feat(core): MCP Gateway — Egress Policy Enforcement Point with credential vault

[eterna2]

Summary

Implement the MCP Gateway as the central Egress PEP (Policy Enforcement Point) from the Enterprise AI architecture. This component sits between the execution sandbox and corporate data/tools, managing access control, credential injection, and data sealing.

Motivation

The MCP Gateway is the "Back Door" guard — it intercepts all tool calls from the sandbox, evaluates per-tool policies via Cedar/OPA, injects managed credentials (so the LLM never sees API keys), and returns opaque handles instead of raw data.

Architecture

Sandbox → ToolProxy → IPC Bridge → MCP Gateway → PDP (Cedar/OPA)
                                                → Credential Vault
                                                → Tool Execution
                                                → Data Vault (seal)
                                                → Return Handle

What Needs to Change

1. Create kest/core/gateway/ package
2. MCPGateway class: HTTP server that receives tool call requests from the IPC bridge
3. Per-tool policy evaluation via configured PolicyEngine
4. Credential vault: stores tool API keys, injects them at execution time
5. Data sealing: wraps tool responses in opaque handles via HandleVault
6. Full audit trail: every tool call is a Kest-verified operation
7. Taint propagation: tools that return sensitive data auto-taint the lineage

Dependencies

• feat(core): opaque handle and handle vault primitives for data sealing #79 (Opaque Handle Primitives)
• feat(core): SandboxProvider interface for network-less execution environments #84 (SandboxProvider interface)

Acceptance Criteria

• MCPGateway class with tool call routing
• Per-tool Cedar/OPA policy evaluation
• Credential injection (tool never sees raw key)
• Data sealing via HandleVault
• Taint auto-propagation
• HTTP server implementation (FastAPI or raw ASGI)
• End-to-end test: sandbox → gateway → tool → sealed handle

Effort

~2-3 weeks (Hard)