chore: allowlist MCP tools + add Learning #68 (rename → stale keystore)

[brandwe]

Summary

Two unrelated small changes bundled — both surfaced during today's session.

• .claude/settings.json — allowlist the conversational, read-only, and content-creation MCP tools (persona-sati + entraclaw) so Claude Code's auto-mode classifier stops flagging legitimate reply-to-DM send_teams_message calls as "unprompted external publishing." Destructive / cross-tenant tools (add_teams_member, delete_teams_message, share_file) deliberately remain absent — the harness keeps gating them as a second check on top of the body's audit_log + sponsor-instruction requirements.
• docs/runbooks/hard-won-learnings.md — add Learning #68: the entraclaw → entrabot rename left the macOS Keychain entry under the old service name (entraclaw), invisible to git grep on the source tree, breaking every Teams/email tool with "Blueprint private key not found." First migration attempt via security(1) -w silently hex-encoded the PEM, producing a "present but unparseable" cert. Round-trip via Python keyring was the correct fix. Four prevention rules captured: enumerate non-repo surfaces (keystore, state dirs, MCP configs, installed scripts) on every rename; never use security(1) -w as a binary-ish data transport; the -w "$SECRET" argv-leakage concern; validate the round-trip in the same process that wrote.

Test plan

• .claude/settings.json parses as valid JSON (python -m json.tool < .claude/settings.json)
• After merge + pull + Claude Code restart, a direct mcp__entrabot__send_teams_message to a fresh DM chat doesn't get blocked by auto-mode
• Body-prompt gate (require_body_prompt.py PreToolUse hook) still fires for the gated tools — the allow list shouldn't bypass the body's own checks
• docs/runbooks/hard-won-learnings.md renders cleanly in mkdocs preview if the doc site is the target audience

Notes for reviewer

• Settings change has precedent in commit bdb28bc ("chore(claude): allowlist persona-sati MCP tools to prevent non-interactive REJECT (chore(claude): allowlist persona-sati MCP tools to prevent non-interactive REJECT #11)") — same shape, broader surface.
• The hard-won-learnings entry was authored by you (Brandon) and was sitting modified in the working tree from earlier in the day — I'm just landing it. Content is unchanged from what you wrote.

🤖 Generated with Claude Code