fix(mcp): preserve investigation input policy

[N0zoM1z0]

Summary

• persist an explicitly configured REA_INVESTIGATION_INPUT_ROOTS_JSON in managed MCP client registrations
• report static JavaScript analysis availability from the investigation-root policy instead of Electron observation configuration
• distinguish live MCP requests outside the administrator ceiling from elicitable grants, with truthful restart guidance
• document the setup and restart workflow and regenerate API documentation

Root cause

The static JavaScript tool correctly failed closed when no investigation roots were configured, but rea setup omitted that non-secret policy from managed MCP registrations. The live capability inventory also grouped static analysis with Electron observation, and permission denials incorrectly advertised no restart even though a running MCP process cannot acquire a changed environment through elicitation or SIGHUP.

Impact

Operators can set the explicit investigation root before approved setup and have it retained in the registered MCP environment. Agents see the tool as policy-disabled before attempting it when the ceiling is empty, and receive accurate administrator-reconfiguration and restart instructions.

The security boundary remains fail-closed: elicitation can add a connection grant only within the configured administrator ceiling and cannot widen it.

Validation

• npm run check
• npm run verify:package with a Linux-only PATH (the inherited WSL PATH contains nonresponsive Windows npm/npx shims that exceed the verifier setup prompt deadline)
• npm run knip
• npm run jscpd
• npm run scan:todos
• focused MCP, permission, Electron, and CLI regression suites

Real Hopper and Ghidra verification was not run because no provider protocol or analysis behavior changed.