fix(mcp): the three tuning tools get a read/write classification (#4102)

CI 6962 — `test_every_registered_tool_is_classified_exactly_once`. The
backup gap is closed (1692 passed); this is the next guard, and the same
shape of one: a tool registered without a classification is silently
denied to a read key, with nothing to notice (#3191).

`retrieval_surfaces` and `retrieval_tuning_history` read. Read access
matters more than usual for these two — a session that cannot see the
bar in force, or the reason it was last moved, is one that will move it
again blind.

`tune_retrieval` writes in both senses: the number the arm reads, and
the reason appended to the audit trail.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

src/scribe/mcp/server.py

@@ -131,6 +131,12 @@ _READ_ONLY_TOOLS = frozenset({
     # looked at names that had one (#3191). rule_history records a pull the way
     # the getters above do.
     "rules_due_for_verification", "rule_history",
+    # What each retrieval surface's floor and budget currently are, and what
+    # has been changed about them (#4102). Both pure reads; `tune_retrieval` is
+    # the write and is deliberately NOT here. Read access matters more than
+    # usual for these two: a session that cannot see the bar in force, or the
+    # reason it was last moved, is a session that will move it again blind.
+    "retrieval_surfaces", "retrieval_tuning_history",
 })
 
 # Every tool that WRITES, by name. Nothing reads this set at runtime — a tool
@@ -166,6 +172,9 @@ _WRITE_TOOLS = frozenset({
     "create_rule", "create_project_rule", "update_rule", "move_rule", "delete_rule",
     "create_preference", "update_preference",
     "relate_rules", "unrelate_rules", "mark_rule_verified",
+    # retrieval tuning — a write in both senses: it moves the number the arm
+    # reads, and it appends the reason to the audit trail (#4102).
+    "tune_retrieval",
     # trash
     "restore", "purge_trash",
 })