feat(optimize): mcp-deferral-gaps finding family (part 1 of #614)

[AVSRPA1KR]

Implements part 1 (detection) of the deferral-coverage design, #614.

Adds a read-only mcp-deferral-gaps finding family to optimize — three detectors, no file mutation anywhere in this PR:

• mcp-deferral-off — sessions carrying MCP tool-def overhead with zero ToolSearch invocations and no deferred_tools_delta inventory across the window. Cause attribution, each with its own message and fix: stale ENABLE_TOOL_SEARCH=false (settings env, any scope, or shell profile), non-first-party ANTHROPIC_BASE_URL (reported as unknown proxy — never assumes capability), Vertex AI, all observed Claude Code versions predating default-on tool search (v2.1.7), or a generic fallback.
• mcp-alwaysload-hygiene — alwaysLoad-pinned servers whose observed call rate is below 1 call / 5 sessions. Notes the 5s startup-blocking cost.
• mcp-defer-threshold — ENABLE_TOOL_SEARCH=auto:N overrides whose threshold the estimated def volume never reaches; recommends the tightest auto:N that would defer.

Detection only — no FindingApply payloads, no act changes, no file mutation. Zero new output for users without deferral gaps (deferral-active evidence suppresses the findings). 32 fixture-based unit tests; config readers take an injectable homeDir for hermetic tests.

Live-docs discrepancies noted in the commit body (changelog records default-on at v2.1.7 not first-ship; per-tool anthropic/alwaysLoad lives in server-served _meta, so server-level only).

Refs #614

[iamtoruk]

Merged as part of #631, whose branch carried this PR's commits as its base per the stacking you described. The detection family, all 51 dedicated tests, and the finding text shipped exactly as designed here; the squash credits you as author. Closing this one so the pair has a single merge history. The empirical note from verification, since this PR asked the right question: across 120 real deferral-active sessions the deferred-tool inventory is emitted at session start regardless of usage, so the detector's no-signal heuristic holds with no minimum-usage floor needed. Thank you for the cleanest big first contribution this repo has seen, and looking forward to the part 3 design issue.