feat: gateway visibility-provider adapter (mcp: tag scoping)

[rz1989s]

What

armory-todo becomes the first live gateway visibility provider (SPEC-1b-3 D3): when @getpipher/armory-gateway is installed in the same pi, the extension registers a registerVisibilityProvider via guarded dynamic import. Tags on in_progress todos matching mcp:<server> or mcp:<server>__<tool> scope the session's MCP tools (union across todos); no tags → undefined → config-only pass-through.

• Requires gateway's bare-server matcher widening — landed as armory-gateway#7 (merged, main @ 1b1f75a); the V4 seam pin in this suite proves bare-entry whole-server scope through the REAL module's public seam.
• Provider NEVER throws: internal catch → undefined + warn (a store hiccup passes through unscoped; never the hide-all path). Invalid mcp: tags skip silently — fail-open by design (scoping = convenience plane; fleet mcpDeny = security plane).
• The injected TODO block makes scoping state self-explanatory in every session; parking/completing the todo widens tools back immediately.
• Contract tests via ARMORY_GATEWAY_PATH + symlink helper (no package.json coupling); release gate clones the private sibling + installs its deps before npm test.

Commits

c25e03f pure grammar/collection · 42df1c7 adapter+contract tests+wiring+README+docs · e5b9e55 CI gate + README separator · 153c246 CI fix (gateway-deps install, same as memory's)

V3 dry-run evidence

Run 33830362593 ✅ — SIBLINGS_PAT clone green, all suites fail 0 / skipped 0 incl. ✔ REAL gateway module: registration, convergence, seam-level bare-entry matcher pin; publish skipped (version guard, as designed).

Local evidence

RED→GREEN per task; npm test 18 suites green; final whole-branch review (session model): Yes — 0 Critical/Important.

Docs

docs/SPEC-1b-3-gateway-visibility-provider.md — relocated spec sections + as-built notes.