Secure-by-construction tool registration

A missing MCP annotation walks TrueForge's rollback tool past its own approval gate

TrueForge sorts tools by readOnlyHint and destructiveHint, so a tool declaring neither matches no tag in the approval policy and nothing asks before it touches production, which is why the default has to be deny at both enforcement points.