P0: pin dev tools, honest transports doc, tools-only template

mise.toml: pin cargo-mutants 27.1.0 and cargo-fuzz 0.13.2 (the latest
published, and what is installed) instead of "latest", so mutation and
fuzz runs repeat (plan/served.md I-13, P0).

docs/mcp-interface.md: the spec had two Transports sections, and the
first claimed bearer-token auth on Streamable HTTP. There is none: the
server uses rmcp's default config, whose only guard is a Host check for
localhost, 127.0.0.1 and ::1, with no token and no Origin check. One
section now says so plainly and points to plan/served.md P2 for auth.

ledger-cli AGENTS.md template: "the journal is the evidence - read it,
don't guess" led an agent to cat the journal file instead of asking the
books. The template now says to trace a figure through books.get_entry,
books.search_entries, or books.export (journal or general_ledger), and a
new bullet says the books are reached only through the wanderbooks MCP
tools: never open, list or parse the books' files, not even to look; if
a tool can't answer, say so. The other lines that sent the agent to the
data dir go too: onboarding is triggered by an empty books.chart instead
of a missing journal.jsonl, the CPA paragraph drops the ledger-gui
--data-dir books-data command, and the backup note no longer names the
journal's path. Test agents_md_reaches_the_books_only_through_tools
pins this; agents_md_carries_the_contract no longer expects journal.jsonl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

docs/mcp-interface.md

@@ -77,11 +77,18 @@ they are control roles in the journal (rules.md B-23).
 
 ## Transports
 
-1. **stdio** (build first). For Claude Code, Claude Desktop, local agents.
-   No auth — the OS user boundary is the auth.
-2. **Streamable HTTP** (later in the phase). For remote access (phone, travel
-   laptop). Bearer token, binds 127.0.0.1 or the tailnet interface only.
-   Binding 0.0.0.0 is an explicit human decision, never a default.
+- **stdio** (default): `ledger-mcp --data-dir PATH`. For Claude Code,
+  Claude Desktop and other local agents. No auth: the OS user boundary is
+  the only boundary.
+- **Streamable HTTP**: `ledger-mcp --data-dir PATH --http 127.0.0.1:8080`.
+  Serves MCP at `http://127.0.0.1:8080/mcp` via rmcp's tower integration.
+  **There is no authentication on this transport today**: no token and
+  no Origin check. The only guard is rmcp's default `Host` check, which
+  accepts `localhost`, `127.0.0.1` and `::1`. Any local process that can
+  reach the port can read and change the books. Bind it to loopback only;
+  binding a LAN, tailnet or public interface is an explicit human
+  decision, never a default. Auth, scopes and Origin validation arrive
+  with the served books (`plan/served.md`, P2).
 
 ## Server instructions
 
@@ -725,13 +732,6 @@ posting.
   the agent downloads from Google Drive via the CLI to a temp path, then
   calls this. Keeps Drive credentials out of the server.
 
-## Transports
-
-- **stdio** (default): `ledger-mcp --data-dir PATH`. For local agents.
-- **Streamable HTTP**: `ledger-mcp --data-dir PATH --http 127.0.0.1:8080`.
-  Serves MCP at `http://127.0.0.1:8080/mcp` via rmcp's tower integration.
-  For network clients; bind to loopback unless you know what you're doing.
-
 ## Resources (read-only)
 
 Hand-rolled on `ServerHandler` (rmcp 3.x has no resource macros):