fix(mcp): make agent identity resolution idempotent

resolveAgentId double-suffixed an id the agent echoed back from a prior
tool response (job.assigned_to / notepad): claude-code-abc -> claude-code-abc-abc.
That no longer matched the stored assignee, so completeJob's
`assignedTo === agentId` owner check failed and the agent was locked out of
completing its own job — the recurring 'only that agent or the key works'
report. The completion-key escape hatch was unusable because claim never
surfaces the key.

Fix: if the incoming id already carries this session's token suffix, return
it verbatim instead of re-suffixing. All claim/complete id-passing combos
(omit, base label, echoed resolved id, blank) now converge to one id.

Adds regression tests covering the idempotent round-trip.