auths-mcp-gateway

The bounded-agent MCP gateway: a real-MCP (rmcp) proxy that brokers each tools/call through auths-mcp-core's per-call gate, forwarding only on pass and emitting a signed receipt. Carries the `wrap` subcommand.