fix(mcp): make get_note / get_task share-aware

The injected menu tells the agent to open any hit with get_note(id), and
that menu can list a collaborator's record reached through a shared
project. The fetch was still owner-only, so those lines answered
"not found" — for a record the same user opens fine in the browser.
The agent path was strictly narrower than the web path for the same id.

Same boundary miss as #2093: the list side was widened for sharing, the
fetch side wasn't. Both tools now resolve through get_note_for_user,
apply the trash filter themselves (permission resolution says nothing
about liveness), and attach describe_provenance so a shared record
arrives marked as someone else's rather than passing as the caller's.

routes/tasks.py's parent-title lookup had the same narrowness: a shared
subtask rendered as an orphan when its parent was equally shared.

Four fetch tests across three files were patching notes_svc.get_note and
had to be retargeted — note 2109's third sub-case, caught by grepping
tests/ for the old name before pushing rather than by CI (#2159).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RLwAaV4DQEmVyn496HnEvt

tests/test_mcp_tool_planning.py

@@ -24,16 +24,25 @@ async def test_start_planning_tool_delegates_to_service():
     assert mock.call_args.kwargs == {"user_id": 7, "project_id": 3, "title": "Plan it"}
 
 
-@pytest.mark.asyncio
-async def test_get_task_augments_plan_with_rules():
+def _plan_note(task_kind: str):
     note = MagicMock()
     note.parent_id = None
     note.project_id = 3
-    note.to_dict.return_value = {"id": 9, "task_kind": "plan", "project_id": 3}
+    note.id = 9
+    # Real values — get_task reads deleted_at and compares user_id to the bound
+    # caller, and a MagicMock is truthy on both (note 2109).
+    note.user_id = 7
+    note.deleted_at = None
+    note.to_dict.return_value = {"id": 9, "task_kind": task_kind, "project_id": 3}
+    return note
+
+
+@pytest.mark.asyncio
+async def test_get_task_augments_plan_with_rules():
     applicable = {"rules": [{"id": 1, "title": "r"}], "truncated": False,
                   "subscribed_rulebooks": [{"id": 2, "title": "rb"}]}
-    with patch("scribe.mcp.tools.tasks.notes_svc.get_note",
-               AsyncMock(return_value=note)), \
+    with patch("scribe.mcp.tools.tasks.notes_svc.get_note_for_user",
+               AsyncMock(return_value=(_plan_note("plan"), "owner"))), \
          patch("scribe.mcp.tools.tasks.rulebooks_svc.get_applicable_rules",
                AsyncMock(return_value=applicable)):
         from scribe.mcp.tools.tasks import get_task
@@ -45,12 +54,8 @@ async def test_get_task_augments_plan_with_rules():
 
 @pytest.mark.asyncio
 async def test_get_task_work_kind_has_no_rules():
-    note = MagicMock()
-    note.parent_id = None
-    note.project_id = 3
-    note.to_dict.return_value = {"id": 9, "task_kind": "work", "project_id": 3}
-    with patch("scribe.mcp.tools.tasks.notes_svc.get_note",
-               AsyncMock(return_value=note)), \
+    with patch("scribe.mcp.tools.tasks.notes_svc.get_note_for_user",
+               AsyncMock(return_value=(_plan_note("work"), "owner"))), \
          patch("scribe.mcp.tools.tasks.rulebooks_svc.get_applicable_rules",
                AsyncMock()) as mock_rules:
         from scribe.mcp.tools.tasks import get_task