feat(mcp): add local stdio write mode

[lance0]

Summary

• add [serve].local_writes and nbox serve --local-writes for local stdio MCP writes using the active profile token
• keep shared/network MCP writes on the existing --allow-writes + OIDC + [serve.vault] path, with OIDC identity always taking precedence when present
• bind the server-issued plan store to a write actor (local or sub:<oidc-sub>) so forged, edited, cross-actor, or replayed plans are rejected
• reject --local-writes on HTTP in this first cut, including loopback, and update ADR/docs/skills around the local-first split
• echo --local-writes from nbox serve --local-writes --print-config so generated local MCP recipes actually enable the mode

Tests

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features --locked -- -D warnings
• cargo clippy --all-targets --no-default-features --locked -- -D warnings
• cargo test --all-features --locked
• cargo test --no-default-features --locked
• bash scripts/lint_skills.sh