fix: control port needs a per-launch token; MCP tool annotations tell the whole truth (#205) (#901)

solidcraft --control PORT writes a random per-launch token to a user-only file (<data>/control/PORT.token; 0700/0600 on Unix, icacls on Windows; SOLIDCRAFT_CONTROL_TOKEN overrides) and refuses any connection whose first request lacks it. mcp --connect, the demo and packaging smoke clients send it. MCP execute/batch/open/save/export/screenshot are annotated destructive and open-world, new_design destructive. Docs: control-protocol.md, mcp.md, AGENTS.md, pending release note in releasing.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/solidcraft/src/main.rs

@@ -286,7 +286,7 @@ fn main() -> eframe::Result {
             b.with_x11();
         }));
     }
-    eframe::run_native(
+    let result = eframe::run_native(
         "SolidCraft",
         options,
         Box::new(move |cc| {
@@ -344,7 +344,9 @@ fn main() -> eframe::Result {
                 space_mouse,
             }))
         }),
-    )
+    );
+    control_server::remove_token_file();
+    result
 }
 
 /// Whether to run through XWayland rather than native Wayland. winit has no file drag-and-drop