feat(mcp): tool-call audit log + analyzer, hardened index_file disk-read

Audit log:
- Opt-in via AXIS_TOOL_LOG=path.jsonl env var (off by default, zero overhead).
- Records ts, session id, tool name, and arg KEYS (never values).
- scripts/analyze-tool-log.mjs aggregates per-session lifecycle adoption,
  cold-pickup rate, tool frequency, orphan tools, and dangling-lock
  patterns. Foundation for measuring tool uptake across agents.

Hardened index_file disk-read path (regression from previous commit
2cddbe24 — security review flagged path traversal + remote exfiltration):
- Resolve every input against process.cwd() as project root; absolute
  inputs are rebased, not honored.
- realpath() + containment recheck to defeat symlink escapes.
- Sensitive-file blocklist (.env*, .git/, .ssh/, .npmrc, .pypirc, ssh
  keys, credentials*, secrets*) even when inside the project.
- 1 MiB size cap. Pass content explicitly to bypass.
- metadata.filePath sent to the remote API is the relative form
  (basename for absolute inputs) — don't leak user FS layout.

The 'agent supplies content' path is unchanged; only the new
disk-read fallback is gated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>