Add hybrid shared runtime routing

[NavinAgrawal]

Summary

• add default-local hybrid routing for normal upstream tools/call requests
• route only allowlisted stateless shared-mode tools to shared workers with tenant, team, and quota context
• split daemon tool-call handling into a dedicated mixin to keep size gates clean
• document the hybrid routing guardrails and protocol contract

Verification

• private red: ModuleNotFoundError for mcp_broker.hybrid_router before implementation
• private focused suite: 108 passed, 0 failed, 0 skipped
• private make precommit PYTEST_WORKERS=0: 1434 unit passed, 152 journey passed, 0 failed, 0 skipped
• private make maintainer-violations PYTEST_WORKERS=0: 0 violations, 12 advisories
• private make maintainer-grade-quality PYTEST_WORKERS=0: A+ 100.0, 0 findings
• public make precommit PYTEST_WORKERS=0: 1434 unit passed, 118 journey passed, 0 failed, 0 skipped
• public make maintainer-violations PYTEST_WORKERS=0: 0 violations, 12 advisories
• public make maintainer-grade-quality PYTEST_WORKERS=0: A+ 100.0, 0 findings
• public secret gate: GitHub secret scanning disabled, GitGuardian check-runs not failing

Mutation was not run locally per Mac load governance.