Merge origin/main into fix/mcp-readonly-annotations

Adapt the readOnlyHint coverage test to post-0.2.5842 main: the tools
list gained codedb_explain and codedb_list_dir, both read-only, so the
per-profile assertion must expect hints on them too.