R23: governed Remote Commander MCP R1

[bitmaster162]

Scope

Adds a fail-closed Remote Commander extension on top of the existing ContinuityOS MCP server.

Added

• capability_status
• system_info
• root-bounded fs_list
• root-bounded bounded UTF-8 fs_read
• sensitive credential/key denial, including .git, SSH/GPG/cloud credential dirs and common local auth files
• tests for disabled-by-default, containment, secret denial, binary refusal, and governed execution invariants
• R1 design/boundary document

Governance invariant

No second/direct shell implementation is introduced. Mutation-capable execution remains exclusively on the existing preflight_exec -> GateBroker -> execute_preflight path.

Final R1 evidence

• current master/base: 2c701b2463f62f8e43374a8f40cdb289d0bc1bad
• R1 head: 84cf11c679f63db853cf3aa14996a811d01d1bc2
• compare: ahead 6 / behind 0
• review-gates Ubuntu: PASS
• review-gates Windows: PASS
• CodeQL: PASS
• P0 Unified Shadow Continuity: PASS
• review threads: 0
• submitted reviews: 0

Explicit non-scope

R1 remains stdio/local. It does not expose an inbound port or remote HTTP listener.

Follow-up

R2 is isolated in dependent PR #198 and adds the server-side Pro read-only profile plus Secure MCP Tunnel transport. R1 merge remains subject to the project human merge gate.