Feat/tm capability telemetry - #443

…d why a call was refused

Registry telemetry recorded only a tool name at entry, and every error path returned
through `failed()` without recording anything.

- `trackMCP` takes an optional `extras` object (scalars only), merged into the row.
  Existing callers are unaffected.
- invokeCapability and describeCapability record the capability name, method, path, mode
  and product once resolved; invokeCapability adds `upstream_ok` and `upstream_status`
  when the product answers. `invoke()` returns 4xx/5xx rather than throwing, so `success`
  keeps its tool-level meaning and those two fields carry whether the call worked.
- searchCapability records result count, total matched, truncated, weak_match and
  coverage, plus the search text.
- A `refuse()` helper records and returns in one step, so every refusal carries a reason
  (unknown_capability, missing_parameter, bad_parameter_type, destructive_blocked,
  permission_not_granted, change_summary_missing, product_ambiguous, no_base_url).
  Refusals that never reach the network now produce a row.
- Free text (`search_query`, `change_summary`) passes through `redact()` first: emails,
  URL credentials, JWTs, opaque tokens, IPs, phone numbers and long digit runs are
  replaced by shape, with no word lists, then capped at 200 characters. It fails closed,
  dropping the field rather than sending raw text. Names have no shape and are not
  covered; the module documents this.

Registry rows stay identifiable by their tool names, and no field changes meaning for
any existing tool.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>