Add guarded analytics MCP authority and native delivery

[shahryar-internal]

Summary

• add one-time founder-DM authority for a guarded analytics MCP tool
• validate the discovered tool contract immediately before signed dispatch
• render only closed, locally verified native Slack cards with durable idempotency
• preserve forced transient Gemini precedence over individual model credentials
• integrate the prerequisite durable delivery and runtime authority foundations

Safety

• no provider credentials or organization-specific values are committed
• public turns cannot supply trusted Slack identity or authority headers
• analytics cards are signed, exact-target-bound, and verified again before rendering
• unsupported or stale contracts fail closed

Verification

• independent exact-tree review: code GO
• focused affected suites: 416 checks passed before public-safe metadata rewrite
• public-safe branch tree is byte-identical to the reviewed candidate
• branch CI is running; live Chrome/Slack smoke remains a pre-merge activation check

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[shahryar-internal]

Exact head 2df95bd4438c47dbce2e91aa70271e753fd2ecb1 passed the complete fork CI matrix: lint/Prettier/Knip/Oxlint, TypeScript, all five core shards, real Postgres tests, CLI, and all plugins. Evidence: https://github.com/shahryar-internal/qm/actions/runs/33362752022. Live activation remains separate and will use Chrome on macOS, not Firefox.

[shahryar-internal]

@16francej This paired founder-analytics change is CODE-reviewed and the fork CI is fully green (run 33362752022). The Command Center counterpart is now deployed to dev in fail-closed mode; activation still waits on this upstream merge. When you have a moment, could you review/merge this PR? Maintainer edits are enabled.