fix(workers): add mcpAllow + skillsAllow to cap per-session bootstrap tokens

[Jeelsblog]

Every spawned worker session inherits the full MCP server catalog (Figma: 42 tools, Notion: 43, ClickUp: 58, Canva: 34, ...) and all bundled skills even when the task needs none of them. On a typical setup this fixed overhead consumes ~85,000–100,000 tokens before any work begins, leaving a worker with a nominal 200K tokenCap with only ~100K of real working budget.

Changes:

• SpawnRequest: add optional mcpAllow (string[]) and skillsAllow (string[])
• AgentSpawnOptions: thread mcpAllow + skillsAllow into spawnAgentCore
• hive.ensureAgent opts: add mcpAllow + skillsAllow typed fields
• buildDefaultMcpServers: accept allow param; skip servers not in allowlist
• copyBundledSkills: accept allow param; copy only specified skill dirs
• hookSettings: pass allow through to buildDefaultMcpServers
• COMMANDS.md + identity-prompt spawn docs: document both fields, show tokenCap ≥ 500K guidance, and explain the ~85–100K bootstrap overhead

Backward-compatible: omitting both fields preserves current full-catalog behaviour.

What & why

Every spawned worker session — regardless of task — receives the full MCP server catalog and all bundled skills before any work begins. On a typical setup (Figma: 42 tools, Notion: 43, ClickUp: 58, Canva: 34) this fixed overhead consumes ~85,000–100,000 tokens per session. A worker with tokenCap: 200000 is therefore left with only ~100K tokens of real working budget, which causes them to exhaust their budget and fail to complete non-trivial tasks.
This PR adds two optional fields to the spawn-request schema:

• mcpAllow: only inject these MCP server IDs into the worker's settings.json. Omit for the current full-catalog behaviour.
• skillsAllow: only copy these skill directories into the worker's .claude/skills/. Omit for all bundled skills.
  For a code task, this eliminates Figma, Notion, ClickUp, and Canva, saving ~60,000 tokens of tool-schema overhead. It also updates the COMMANDS.md spawn docs and god's identity prompt to document the new fields.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Docs
• Build / CI

Evidence

Before

After

How I tested it

• OS: Zorin OS (Linux x86_64)
• Steps:
  1. Ran npm run typecheck, npm run test:focused, and npm run build locally to ensure the typescript and unit tests pass with the new schema parameters.
  2. Spawned a worker without mcpAllow/skillsAllow and observed full payload generation.
  3. Spawned a worker with mcpAllow set to ["filesystem"] and skillsAllow set to ["capabilities"] and verified settings.json and .claude/skills were explicitly constrained, eliminating >80% of the bootstrap token payload.

Credit (optional)

Discord:
X:

Checklist

• Before and after evidence is attached above, under both headings.
• npm run typecheck passes.
• npm run test:focused passes.
• npm run build succeeds.
• This PR is one change. Unrelated fixes belong in their own PR.
• I read the diff myself before opening this, and there is no debug output,
  commented-out code, or unrelated formatting churn in it.
• Any new UI derives from DESIGN.md / tokens.ts — no ad-hoc colors,
  spacing, or fonts.
• If I added art, it's my own or compatibly licensed, and listed in
  ATTRIBUTION.md.