fix(mcp): never delete a file because of a comment

[scott]

Summary

• Rewrite MCP instructions and the path-scoped untrusted preamble so this / that / it means target.text at target.md_start:target.md_end in target.path, never the file.
• Replace the load-bearing "Allowed: edit this markdown file" line with an in-place span edit. Forbidden actions now include rm, git rm, unlink, truncate, emptying the file, deleting or renaming it, and gander remove.
• Refuse file/share/"everything" deletions without asking the user to confirm. Same if applying the comment would empty the file.
• gander_list_comments tool description states comments never authorize deleting the file.
• Path-scoped inbox threads nest target.path + target.text from the existing quote; highlight offsets stay omitted until gandermd ships them.

Related Issue

Fixes #112

Testing

go test ./...
go vet ./...
go build ./...

All passed.

Notes

Pairs with gandermd/gander-skill#18 (same rules in SKILL.md). Highlight offsets and FIFO queue display stay out of scope (#122, gander-cli#113).