P0: pin dev tools, honest transports doc, tools-only template

mise.toml: pin cargo-mutants 27.1.0 and cargo-fuzz 0.13.2 (the latest
published, and what is installed) instead of "latest", so mutation and
fuzz runs repeat (plan/served.md I-13, P0).

docs/mcp-interface.md: the spec had two Transports sections, and the
first claimed bearer-token auth on Streamable HTTP. There is none: the
server uses rmcp's default config, whose only guard is a Host check for
localhost, 127.0.0.1 and ::1, with no token and no Origin check. One
section now says so plainly and points to plan/served.md P2 for auth.

ledger-cli AGENTS.md template: "the journal is the evidence - read it,
don't guess" led an agent to cat the journal file instead of asking the
books. The template now says to trace a figure through books.get_entry,
books.search_entries, or books.export (journal or general_ledger), and a
new bullet says the books are reached only through the wanderbooks MCP
tools: never open, list or parse the books' files, not even to look; if
a tool can't answer, say so. The other lines that sent the agent to the
data dir go too: onboarding is triggered by an empty books.chart instead
of a missing journal.jsonl, the CPA paragraph drops the ledger-gui
--data-dir books-data command, and the backup note no longer names the
journal's path. Test agents_md_reaches_the_books_only_through_tools
pins this; agents_md_carries_the_contract no longer expects journal.jsonl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

crates/ledger-cli/tests/init.rs

@@ -144,7 +144,6 @@ fn agents_md_carries_the_contract() {
         "Posted is forever",
         "reversing entries",
         "receipt",
-        "journal.jsonl",
         "onboard",
         "chart_template",
         "to the cent",
@@ -156,6 +155,32 @@ fn agents_md_carries_the_contract() {
     }
 }
 
+/// The agent reaches the books only through the MCP tools. The scaffolded
+/// AGENTS.md once said "the journal is the evidence — read it", and an
+/// agent `cat`ed the journal file instead of asking the books.
+#[test]
+fn agents_md_reaches_the_books_only_through_tools() {
+    let tmp = tempfile::tempdir().unwrap();
+    let books = tmp.path().join("b");
+    assert!(new(tmp.path(), &books, &[]).0);
+    let md = fs::read_to_string(books.join("AGENTS.md")).unwrap();
+    for phrase in [
+        "only through the",
+        "wanderbooks MCP tools",
+        "Never open, list or parse",
+        "books.get_entry",
+        "books.search_entries",
+        "general_ledger",
+        "can't answer, say so.",
+    ] {
+        assert!(md.contains(phrase), "AGENTS.md says {phrase:?}");
+    }
+    // Nothing points the agent at the books' files.
+    for path in ["books-data", "journal.jsonl", "wanderbooks.db", "read it"] {
+        assert!(!md.contains(path), "AGENTS.md never mentions {path:?}");
+    }
+}
+
 #[test]
 fn rerun_refused_without_force_and_never_clobbers_the_profile() {
     let tmp = tempfile::tempdir().unwrap();