test(mcp): drive session re-attach and RAG attach filter guards through their real entry points

- use_session_applies_persisted_mcp_tools_immediately now loads a session
  file from disk through the real use_session, proving the post-assignment
  filter refresh applies a re-attached session's persisted allowlist.
- New use_rag_does_not_drop_role_filters loads a yaml-driver RAG through
  the real use_rag and proves the tool-scope rebuild recomputes the role's
  filter layer instead of dropping it.
- Seed the process-wide client/model registries in a pre-main ctor (new
  ctor dev-dependency) so model resolution is deterministic across test
  orderings; the seed exposes only an embedding model so tests that assert
  'no chat model available' keep their premise.

Cargo.lock

@@ -1685,6 +1685,7 @@ dependencies = [
  "colored",
  "comfy-table",
  "crossterm 0.29.0",
+ "ctor",
  "dirs",
  "duckdb",
  "duct",
@@ -1907,6 +1908,16 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "ctor"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "914a755b7c2d4af2bdcff7ce1739e2db9a1b81a9b07123d8015786ae03c0980d"
+dependencies = [
+ "link-section",
+ "linktime-proc-macro",
+]
+
 [[package]]
 name = "ctutils"
 version = "0.4.2"
@@ -3833,6 +3844,18 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "link-section"
+version = "0.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39c29a617ce3df32c08497bdc1ab6e2376e0b17948ac166a2fbe5977c5954cd9"
+
+[[package]]
+name = "linktime-proc-macro"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e57c38c1e860fd37c604281cdfb1dd2216977fd76a50f85ba2f388ef3219616"
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.4.15"