feat(mcp): expose index freshness and relationship provenance

[vvenegasv]

What does this PR do?

This PR adds machine-readable freshness and provenance evidence to MCP responses, helping clients determine whether results come from a current index, a stale or partial index, direct source resolution, or heuristic inference.

Changes include:

• Persisting the indexed Git HEAD and file coverage metrics for each project.
• Extending index_status with additive evidence about indexed/current revisions, working tree state, freshness, coverage, and known limitations.
• Returning edge_evidence from trace_path and trace_call_path when relationship provenance is available.
• Preserving backward compatibility by returning unknown or unavailable values when older indexes do not contain the new metadata.

Why is this needed?

Consumers of the MCP need factual and inspectable signals to decide whether a result can be trusted as-is, whether the repository should be re-indexed, or whether the result should be verified directly against source code.

Rather than exposing an opaque reliability score, this change provides the underlying evidence needed for clients to make that decision.

Checklist

• Every commit is signed off (git commit -s)
• Tests pass locally (make -f Makefile.cbm test)
• Lint passes (make -f Makefile.cbm lint-ci)
• New behavior is covered by a test

Tracking

Closes #786

[DeusData]

Thanks @vvenegasv — this is the version we'll take for the index-freshness / relationship-provenance feature (the tested superset of #544, which I've now closed in its favor). The core is read-only, additive MCP output and reviewed clean.

One ask before merge: please split out the changes bundled in here that are unrelated to this feature —

• the cli.c ZIP-size cast,
• the cypher.c redundant NULL-check removal, and
• the git_capture "empty-output is success" refactor.

They're benign (and arguably correct), but they're out of scope for this PR — as a separate focused PR they're trivial to review and land. With those split out and CI green, this is good to go. 🙏

[vvenegasv]

Hi @DeusData, the requested changes have been applied and CI is now green. Please let me know if there’s anything else you’d like me to adjust. Best regards.

[DeusData]

Thanks for the freshness/provenance work. Because this adds MCP response fields and shells out through cbm_popen, please add focused tests showing repo paths are validated/quoted safely, including paths with spaces/quotes where applicable, and document the additive response fields for client compatibility. Please also link the tracking issue.