delego 0.3.1 — MCP + CLI UX from live testing

[koishore]

What

UX patch driven by friction hit while exercising the MCP server end-to-end today. No protocol change (still 0.3); package 0.3.1.

MCP server

• Structured output: tools return dicts/lists (FastMCP structured content) instead of JSON-encoded strings — consuming agents no longer parse twice.
• Broker refusal is deny-shaped: a #fragment on an allowed action's URL now returns outcome: "deny", executed: false with the reason, instead of a raw BrokerRefusal tool error (receipt already written since 0.3.0).
• Uninitialised home → setup_required payload with the exact delego init command, not a stack trace. Init stays deliberate — no silent key generation.
• New delego_pending tool (read-only). Approve/deny remain deliberately absent from the MCP surface: the agent that proposed an action must never be able to approve it. Stated in the module docstring, tool docs, README, ARCHITECTURE.
• The pending-tool absence of approve/deny is asserted in tests.

Engine

• Fingerprint/intent mismatch denials name what the approval was issued for (action summary / instruction — already visible via pending and the ledger, so nothing new is revealed). CTK resolve substring expectations still pass (text is appended after the matched prefix).

CLI

• delego approve/deny echo the action + instruction — the consent moment shows what was authorised, not just an id.
• delego verify --anchor-file PATH — checks against the stored head, advances it only after a clean verify; mutually exclusive with --expected-head.

Verification

• 51 tests pass (8 new: MCP structured output, setup_required, deny-shaped refusal + its receipt, pending view + trust-boundary assertion, mismatch self-correction reason, approve echo, anchor-file round-trip + rollback detection + flag exclusivity).
• examples/demo.py green. dev extra now includes mcp, so CI exercises the MCP facade (tests skip gracefully where mcp is absent).
• server.json bumped to 0.3.1.