refactor(systems): one seam — the Systems question rides every read and write of a record

Scribe issue #2570, from the operator's challenge: the invariant is
"always be asking whether what you're touching is a System's territory
and whether the work is filed there" — not a nudge in one corner. The
prior shape failed it twice: the hint fired only on creates (with a
special-cased zero-Systems branch), and get_task/get_note returned
records WITHOUT their Systems, so the read-side reflex had nothing to
fire on (same per-kind asymmetry as #2481).

- attach_systems(): single helper used by get/create/update for tasks,
  notes, and snippets, plus add_task_log. Tagged records always show
  `systems`; an untagged project record carries the `systems_hint`
  question instead. Neither field attaches empty (#2483). Hint is
  owner-only; everything fail-open (#2109).
- untagged_systems_hint unified to ONE question — the vocabulary
  listing varies, the question doesn't; the zero-Systems branch stops
  being special text.
- Docstrings state the uniform contract; floor prose now names the
  read-side reflex (systems visible -> list_system_records the pile).
- Plugin 0.1.27 -> 0.1.28.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/scribe/mcp/tools/snippets.py

@@ -133,9 +133,10 @@ async def create_snippet(
     and it really is the same reusable thing found in another place, prefer
     merge_snippets(existing_id, [new...]) — or record then merge — to unify them
     into ONE canonical record (which then carries every call site as a location),
-    rather than forcing a second copy with force=true. Created untagged in a
-    project that has Systems, the response carries a `systems_hint` naming
-    them — answer it: tag, create the missing System, or deliberately skip.
+    rather than forcing a second copy with force=true. A tagged record shows
+    its `systems`; created untagged in a project, the response carries the
+    `systems_hint` question instead — answer it: tag, create the missing
+    System, or deliberately skip.
 
     WHAT THE GATE MATCHES ON. Exact identity first — an existing snippet at the
     same repo · path · symbol, or holding byte-identical code. Those are certain,
@@ -174,14 +175,7 @@ async def create_snippet(
     if system_ids:
         await systems_svc.set_record_systems(uid, note.id, system_ids)
     data = snippets_svc.snippet_to_dict(note)
-    if system_ids:
-        data["systems"] = [
-            s.to_dict() for s in await systems_svc.list_record_systems(uid, note.id)
-        ]
-    elif project_id:
-        hint = await systems_tools.untagged_systems_hint(uid, project_id)
-        if hint:
-            data["systems_hint"] = hint
+    await systems_tools.attach_systems(uid, uid, data, note.id, project_id or None)
     return data
 
 
@@ -205,6 +199,9 @@ async def get_snippet(snippet_id: int) -> dict:
     # paths, and counting those would inflate exactly the number that is
     # supposed to mean "someone chose to look at this" (#2085).
     record_pulled(user_id=uid, note_id=int(note.id), source="mcp_get_snippet")
+    await systems_tools.attach_systems(
+        uid, note.user_id, data, note.id, note.project_id
+    )
     return data
 
 
@@ -397,11 +394,9 @@ async def update_snippet(
         await systems_svc.set_record_systems(note.user_id, snippet_id, system_ids)
     data = snippets_svc.snippet_to_dict(note)
     data.update(await access_svc.describe_provenance(uid, note))
-    if system_ids is not None:
-        data["systems"] = [
-            s.to_dict()
-            for s in await systems_svc.list_record_systems(note.user_id, snippet_id)
-        ]
+    await systems_tools.attach_systems(
+        uid, note.user_id, data, snippet_id, note.project_id
+    )
     return data