docs(agents,settings): port the write-identity locks — deny MCP content writes, §9 states ruling C (objectui#9418)

docs(agents,settings): port the write-identity locks — deny MCP content writes, §9 states ruling C (objectui#9418) #5167