feat(analysis): add local discovery registry

[limaronaldo]

Summary

• add a crate-private, versioned registry for documented Cursor, Claude Code, and VS Code MCP configuration locations
• add the deterministic D.0 budgets and a separate agentshield.discovery/v1 result model
• parse only allowlisted structural metadata and discard command, args, env, headers, URLs, and unknown values
• enforce redacted path-reference construction so absolute paths and traversal components cannot enter serialized discovery results
• add deterministic IDs, bounded diagnostics, stable envelope ordering, format fixtures, and secret-leak regression tests

Scope

This is D.0 only. It adds no CLI command, public Rust API, filesystem traversal,
network access, subprocess execution, automatic scan, or changes to existing
scan outputs. The temporary module-level dead_code allowance is required by
the accepted split and must be removed in D.1.

The initial registry entries follow current official client documentation for
Cursor global/workspace MCP configuration, Claude Code project .mcp.json, and
VS Code workspace .vscode/mcp.json.

Validation

• cargo fmt --all --check
• cargo check --workspace --all-targets --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo test --workspace --all-targets --locked — 381 passed
• cargo test --workspace --all-targets --no-default-features --locked — 347 passed
• git diff --check

[limaronaldo]

Code review verdict: no blocking findings after fixes. Review covered privacy-safe serialization, deterministic IDs/order, aggregate budgets, unsupported semantics, dependency/public-API drift, unsafe use, and default/no-default feature behavior. One issue found and fixed before this verdict: the 1,024-entry budget was per-source; the envelope now enforces it across the complete invocation with deterministic truncation and a bounded diagnostic. Local gates: fmt, workspace check, all-feature clippy, 381 default tests, and 347 no-default-feature tests pass. Cargo.lock, public API, scan behavior, and existing outputs are unchanged.