fix: control port needs a per-launch token; MCP tool annotations tell the whole truth (#205) (#901)

solidcraft --control PORT writes a random per-launch token to a user-only file (<data>/control/PORT.token; 0700/0600 on Unix, icacls on Windows; SOLIDCRAFT_CONTROL_TOKEN overrides) and refuses any connection whose first request lacks it. mcp --connect, the demo and packaging smoke clients send it. MCP execute/batch/open/save/export/screenshot are annotated destructive and open-world, new_design destructive. Docs: control-protocol.md, mcp.md, AGENTS.md, pending release note in releasing.md.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/releasing.md

@@ -98,6 +98,22 @@ new commits were added. An existing tag or published release is never overwritte
 version after publication. Do not push the version tag yourself: publishing the draft creates
 it at the draft's target commit.
 
+## Notes for the next release
+
+Items to carry into the next release's notes (step 3 below), then remove from here:
+
+- **Security (agents and the control channel, [#205](https://github.com/bherbruck/solidcraft/issues/205)).**
+  Upgrading is recommended for anyone who drives SolidCraft from an AI agent or runs it with
+  `--control` on a shared machine. MCP tool calls now reach files only in the open design's
+  folder (inside home, without its hidden files), SolidCraft's recovery folder and folders
+  given with `--allow-path`; `..`, symlinks that lead out and Windows UNC, device, stream and
+  short-name paths are refused ([#578](https://github.com/bherbruck/solidcraft/pull/578), thanks
+  @kravens). `doc.recovery_discard` deletes only real recovery entries. The control port now
+  needs a per-launch token from a file only the user can read, so other local users can't drive
+  the app; `solidcraft-cli mcp --connect` finds it by itself, other clients must send it (see
+  docs/control-protocol.md). MCP tool annotations no longer understate side effects. Reported by
+  @CalvinEthos.
+
 ## Verify and publish
 
 When the task authorizes shipping a release, agents should complete these steps without