feat(loop): operational RAG->tool-call->policy/trust gate->signed-receipt loop + canonical live MCP at /mcp/ + /ask-and-act consumer UI; de-advertise retired hatun-mcp Space on /hatun-mcp page

sync(space): full source mirror — resolve all GitHub<->Space drift (CTO)