MCP `run_log`: read a run's log, or its last N lines, with the same rules as GET …/runs/{id}/log #3796

For agents that work through MCP and not a git client: today src/http/mcp.ts has no tool that reads a run's log, so an agent has to fall back to the REST API.

Done:

• [ ] A read-only MCP tool run_log (no writes), placed directly after the watch tool in src/http/mcp.ts so it does not collide with other tool additions. It takes repo, run (the run id) and an optional tail (1–2000 lines), and answers through runLog in src/actions/runs.ts with the same access rules as the REST route: a repository the caller cannot read is not found.
• [ ] Every argument is validated in inputSchema (types, maxLength, enums), and the description is one sentence, so tools/list stays small (#3366).
• [ ] A hidden log (logHidden) is not found, exactly as on the REST route.
• [ ] test/mcp-run-log.test.ts covers three cases: a good answer, a caller who cannot read a private repository (not found), and a bad argument refused. Each case fails without the tool.

Files: src/http/mcp.ts, test/mcp-run-log.test.ts (new), docs/MCP.md (one line). Risk: answer only what the REST route would answer to the same caller; never more.