fix: verify MCP history reads

[vycdev2]

Summary

• read MCP history and pending files through verified descriptors rather than trusting directory-entry metadata
• retain the verified file snapshot for metadata parsing and response rendering
• add a regression test for a regular history file replaced by a symlink after enumeration

Verification

• npm test — passed: 195 tests
• git diff --check — passed

Risk

• Low: the change is limited to saved-history reads and fails closed by skipping files whose identity or directory chain cannot be verified.

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.

[vycdev]

Found a performance regression in src/mcp/server.ts around lines 531-574: the new enumeration loops synchronously read and retain every history file before applying channel/date filters and limit (which only happens around lines 591-605).

For example, read-message-history with a specific channel and limit: 1, without a search, now reads all legacy and v2 channel history into memory. Previously it selected the candidate filenames first and read only the requested files. On a long-running server this makes even a one-file request block the bot event loop and allocate memory proportional to the complete archive. readStoredHistoryFile also omits the verified reader's optional byte limit, so the response character budget does not bound this work.

Please preserve the verified-descriptor protection but filter filename metadata and select candidates before reading file bodies. Handle pending-file metadata and content searches with bounded reads as needed, and add a regression test that a channel-specific limit: 1 history request does not read unrelated file bodies. Leaving this PR open for that change.