Expose retained Context evidence discovery
Agents need retained source-version discovery for saved Context requests. Adds authenticated GET /api/context/evidence, existing Context command support, and concrete standard MCP tool with shared authorization and strict real-adapter response validation.
Returns up to50 exact version/source IDs, provenance and current/history status. GET rejects repeated/unknown fields, supports browser preflight, disables caching and uses the existing shared limiter at120 authenticated account requests per60-second window across cursors/workspaces.429 includes Retry-After; unavailable limiter fails closed503. POST/MCP quotas are not introduced. No original contents, storage URLs, rights decisions, collection or paid calls. Delegated OAuth remains excluded pending organization-grant audit. Requires Database #92; no deployment/customer intake.
Validation:61 focused tests(46new), including real-adapter GET/MCP routing, SDK discovery, scope/fingerprint/withdrawal checks, browser preflight and throttle failure paths. Two throttle regressions failed before fix. Prior188OAuth compatibility tests pass(one skipped); full lint, scoped formatting, GET/OAuth dependency typechecks and diff checks pass. Fresh05b7e911 CI/review pending. Fixtures are not production transport parity.