fix(mcp): re-land leadbay_getting_started with the 8 review findings fixed

[ArtyETH06]

Re-lands the walkthrough backed out by #176, with every finding from the automated review on #175 fixed.

Merge #176 first — this branch carries the revert, so after #176 lands its diff is just the feature, corrected.

The 8 findings

	Finding	Fix
P1	The paid reveal told the agent to pass a singular leadId — a key leadbay_enrich_titles never reads. It would be dropped, and with no leadIds the tool falls back to the top of the wishlist: the confirmed one-contact reveal could spend on several leads.	Both surfaces now say leadIds: ["<id>"], and say why the array matters.
P1	execute returned the module-level manifest by reference, and the server mutates results in place to attach _meta.update_available / _meta.notifications — so per-call metadata stuck to the singleton and could replay on a later call.	structuredClone per call.
P1	The live eval recorded every call as ok:true, output_len:0 and never read the tool_result. A call failing BAD_INPUT / LAST_PROMPT_REQUIRED still satisfied required_calls and reached the judge as a success.	Results parsed into the evidence; required_calls / required_order read only calls that succeeded. forbidden_calls still reads every call that fired — attempting a banned call is the violation.
P1	no-unprompted-enrich-spend leaned on a missing fixture to make a paid launch fail — but this runner ignores fixtures and hits the real API. The regression it guards would have been paid for in real credits.	noSpend: true blocks /leads/selection/enrichment/launch inside the spawned server, before the network. The free mode:"discover" half still runs live.
P2	Gate 4 needs leadbay_enrich_titles + leadbay_bulk_enrich_status, which a read-only deployment (LEADBAY_MCP_WRITE=0) filters out — the tour offered a button that dies on the click.	Gate 4 declares requires_tools + unavailable; the agent checks its own tool set first and closes at gate 3 instead.
P2	allowed_calls was declared by scenarios and read by nobody, so a scope eval could fan out into real tools and still be decided by a judge score.	Enforced as a whitelist, mechanically, before the judge.
P2	The unconditional STOP line must be the last line of the message — but ENDING B requires the 1:1 offer to be last. The agent had to violate one, reopening the displaced-offer failure.	STOP scoped to gate hand-backs; ENDING B says so at the point of use.
P2	WORKFLOWS.md still required a CRM check at gate 4 and a gate 5 scheduling handoff — gates that were cut before the feature shipped, making the normative criteria impossible to satisfy.	Criteria rewritten to the four gates that exist.

Version

0.28.0 is already published to npm from a different commit, so the CHANGELOG section claimed a shipped version. Renumbered to 0.29.0 across package.json, server.json, the plugin manifest and its npx pins.

Tests

pnpm -r test → 1351 passing (up 9), typecheck + build clean. New coverage in two new files: getting-started-codex-review-fixes.test.ts and eval-runner-evidence-and-spend-guard.test.ts.

Two pre-existing eval helpers are modified (live-session-runner.ts, live-mcp-server.ts) — the two P1 eval defects have no other correct home, and #175 already modified llm-judge-shared.ts on the same grounds. No existing *.test.ts spec is touched.

Not covered

• No live /eval run in this PR. The runner's own evidence handling changed, so the honest move is to re-run the two gate scenarios once revert(mcp): back out leadbay_getting_started (#175) pending Codex fixes #176 lands and paste that block — the previous run's numbers no longer describe this code.
• The ci(release): drop sudo so npm upgrade actually takes effect #51 over-claim failure documented on feat(mcp): leadbay_getting_started — guided first-run walkthrough #175 (gate 4's side door via leadbay_research_lead_by_id, and claiming a phone/email it never received) is still unfixed — out of scope here, which was the 8 review findings plus the version.

Closes https://github.com/leadbay/product/issues/3952