Add live operation discovery for confined agents

[areshand]

Why

In the production trace, the agent ran multiagent ops describe without an operation ID, searched a permit fixture, saw only two example IDs, and incorrectly concluded those were the only available operations. The runtime has exact-operation lookup but no catalog discovery command.

What changes

• Add multiagent ops list [--direct-only] [--query TEXT].
• Fetch the catalog live through the supervisor from prod-mcp; do not introduce a local catalog.
• Return compact discovery metadata including access, mutation, approval requirements, directEligible, requestPath, and explicit direct-ineligibility reasons.
• Keep parameter schemas behind ops describe OPERATION_ID.
• Permit all confined roles to use the read-only list operation.
• Tell read-only roles to use only requestPath=supervisor-direct entries; reviewed-ops entries remain in the operations/review lifecycle.
• Record the discovery-versus-authorization boundary in the architecture decision.

Validation

• cargo fmt --check — passed
• cargo test — 95 passed
• Focused authorization-metadata regression test — passed after the follow-up update

Deployment

Source-only PR. It does not deploy, grant provider credentials, or change operation authorization. It is intended to ship with the complementary prod-mcp capability-scope PR.