fix(mcp): classify list_shapes as read-only for read-scoped API keys

The auth guard test caught it: a read-shaped tool in neither set fails
closed for read keys, silently. list_shapes reads the ledger and writes
nothing; classify_shapes stays write-scoped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/scribe/mcp/server.py

@@ -110,6 +110,9 @@ _READ_ONLY_TOOLS = frozenset({
     # Which repos map to which project. Read-only by nature; bind_repo /
     # unbind_repo are the writes.
     "list_repo_bindings",
+    # The shape ledger's todo query (#2789). Reads only — classify_shapes is
+    # the write, and it is deliberately NOT here.
+    "list_shapes",
 })
 
 # Read-SHAPED tools that must NOT be reachable with a read key — a getter that