feat(mcp): write, test and delete this instance's own playbooks (#5748)

#5748 "MCP can write, edit and test this instance's own playbooks
(steward-local)": two admin tools beside run_playbook, so an agent can
build automation for these hosts that isn't part of Steward itself.

- save_playbook(playbook, content, source="steward-local", replace=false)
  goes through the editor's own validate_playbook_yaml and
  write_playbook. A playbook that isn't a list of plays comes back with
  the YAML error and its line, and nothing is written. An existing file
  is overwritten only with replace=true. steward-builtin is refused
  (Steward's playbooks change in its repository), as are git sources
  (their repo owns them).
- After writing, `ansible-playbook --syntax-check` runs against a
  throwaway localhost inventory (no host contacted, 60 s), so a module
  name Ansible can't resolve shows before any run. The result rides the
  reply; the file is kept either way.
- delete_playbook(playbook, source="steward-local").
- Both audit as ansible.playbook.created/updated/deleted, "<user> via
  MCP", with the size and never the content.

The testing loop is the existing one: run_playbook defaults to check
mode, on one target, then get_ansible_run. The integration test does
that loop with the real ansible-playbook.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/core/mcp.md

@@ -95,6 +95,17 @@ Each role includes the tools of the roles above it in this list.
 `set_alert_action` (the playbook a rule runs when it fires), `delete_monitor`,
 `delete_alert_rule`, `prune_docker`.
 
+`save_playbook` and `delete_playbook` write this instance's own playbooks into
+`steward-local`, the same as Steward's editor (#5748). That is automation for
+these hosts that isn't part of Steward itself; Steward's built-in playbooks are
+changed in its repository, and a git source by its repo, so both are refused.
+A save must parse as a list of plays or nothing is written; it won't overwrite
+an existing playbook without `replace=true`; and it then runs
+`ansible-playbook --syntax-check` (no host contacted) and says what that found.
+The loop for building one is save → `run_playbook` in check mode on one target
+→ `get_ansible_run` → fix and save again → apply with `check=false`. The audit
+row records the size, never the content.
+
 The client sees each tool's full contract: arguments, what an empty value
 means, and what comes back. That contract is the tool's docstring, so read the
 docstrings in `steward/mcp/tools/` for the detail.