MCP upstreams

Adopt other MCP servers into the governed catalog. The trust tier on a connection drives everything: how tools are adopted, whose words the assistant sees, and what happens when the upstream changes (drift). Adopted tools become normal capabilities — review, permission tiers, access groups and the Register apply unchanged.