mcp serve: warehouse_add is open without --allow-write #1649

Found during the v0.12.9 release review (#1647).

mcp serve exposes warehouse_add without --allow-write (MCP_OPEN_WRITE_TOOLS in src/altimate/tool-cli/allow-list.ts), so a calling agent can save a connection (including credentials it was given) to local configuration, or register a DuckDB/SQLite file at any path. tool run needs --allow-write for the same call; warehouse_remove and warehouse_install_driver are gated in both.

This is documented in configure/mcp-servers.md and the v0.12.9 changelog. Options: gate warehouse_add behind --allow-write too, or allow only local file types without it.

Deferred because it changes the default MCP tool set (more than a release fix).