fix(mcpfed): ReadOnlyHint can no longer lower federated tool risk below the floor

[xunholy]

Summary

Third trust-boundary safety fix in the series (after MCP output quarantine v0.766 and federation output bound v0.767). A gate-bypass via untrusted metadata.

The federation risk classifier (mcpfed.classify) trusted ReadOnlyHint — a tool annotation the external, untrusted MCP server controls — and returned risk.Low unconditionally. A malicious or compromised federated server could mark a destructive tool read-only to have it classified Low, which:

• skips the confirm gate (Low is below any Medium/High threshold),
• passes the audit fail-closed gate (RequireOpen only refuses ≥ High),
• and is permitted even in read-only mode (read-only refuses only > Low).

That defeats the documented "every federated tool is at least High" guarantee those gates rely on.

Fix

Enforce the invariant the docs already claimed — server annotations may raise risk but never lower it below the operator's configured floor (RiskDefault, default High). classify() now returns defaultLevel for ReadOnlyHint=true (treated as "no escalation needed"), never Low. A read-only federated tool reaches Low only when the operator deliberately sets that server's RiskDefault=low. DestructiveHint→Critical and OpenWorldHint→bump are unchanged (both raise, both safe).

Verification

• Updated the two tests that pinned the vulnerable behaviour; corrected doc.go; added attack-case coverage: destructive+readonly stays Critical; read-only held at the High/Medium floor; read-only reaches Low only via an explicit operator default.
• task ci green (lint 0 / vet / build / test:full 0 fail / govulncheck clean); task eval 17/17.
• Behaviour-isolated to the inbound federation classifier; the MCP server's outbound ReadOnlyHint annotations are unaffected.

Safety fix — anchors v0.768.0.