feat(agent): advertise analysis-run discovery boundaries

[sam-bretz]

What Changed

Adds analysis-run discovery metadata contracts and explicit unavailable capabilities to the OSS Agent Access surface.

How It Works

The list/detail MCP tools and authenticated REST routes return unsupported_capability. The OSS server has no analysis-run store or engine. Existing bridge behavior, Python 3.10 compatibility and capability bounds are preserved.

QA Overview

• OSS server suite: 59 passed against disposable PostgreSQL with current core installed.
• Authentication, capability-fixture consistency and MCP bounds covered.
• Independent Claude review: confirmed broad vendor-copy issues removed, final verdict has no blocking findings. Fixture formatting narrowed afterward.
• Managed/local implementation is a separate companion PR. No provider calls, hosted validation or analysis execution claimed.