M13: harden MCP trust boundary

contracts/mcp-tools.json

@@ -1,8 +1,19 @@
 {
   "_note": "Fleet Ops's own published tool contract. The live ITWorx MCP Hub connector (ITWorx_MCP_Hub repo, connectors/mobilityops/) wraps these under its own dotted namespace (mobilityops.operations.summary, .attention.list, .vehicle.get, .knowledge.search) -- that naming is Hub-owned. deprecated_aliases below are Fleet Ops's own prior internal audit-label names, kept only so existing clients/dashboards referencing them don't break.",
   "provider_id": "mobilityops",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "required_scope": "mobilityops.read",
+  "authentication": {
+    "service_header": "X-Service-Token",
+    "client_header": "X-Client-Id",
+    "client_pattern": "^itworx-mcp-hub:(readiness|mobilityops:[A-Za-z0-9][A-Za-z0-9._:-]{0,127})$",
+    "optional_tenant_header": "X-Tenant-Id",
+    "tenant_must_match": "northstar-mobility-demo"
+  },
+  "observability": {
+    "response_headers": ["X-Correlation-Id", "X-Tenant-Id", "Cache-Control"],
+    "knowledge_response_headers": ["X-Sources-Available", "X-Sources-Returned"]
+  },
   "tools": [
     {
       "name": "fleet_ops_get_operations_summary",