Outward-facing and hard-to-undo actions ask first in the conversation, and act once on a yes #7650

Part of #7640. Release, delete, money, credentials and admin settings are asked in the conversation before they are done.

Done when:

• [ ] One list in src/crew/conversation_confirm.ts names the asking tools/actions: release and rollback, archive and delete, subscriptions and budgets, secrets, tokens, ssh keys, and every needsAdminScope tool
• [ ] A via token calling one answers needs_confirm with a confirm id and one sentence of what will happen; a confirm turn is stored
• [ ] The person's yes (a same-origin POST from their own session, never the agent) performs the stored call exactly once; a second yes or a yes after 10 minutes is refused (tests)
• [ ] Admin-scope tools become reachable this way for a person who is an admin, so the agent can do what the person may, deliberately
• [ ] Where the action has an undo (take_back, revert, reopen), the result turn names it
• [ ] tools/list for an admin holding a non-admin token names the hidden admin tools in one sentence and how to reach them (an admin-scope token, or a confirm in the conversation); docs/MCP.md marks those rows (admin scope); a test lists with an rw admin token and finds the sentence and no repo_settings, and bun test test/mcp-size.test.ts passes

Files: src/crew/conversation_confirm.ts, src/http/mcp.ts, src/core/conversations.ts, docs/MCP.md, test/conversation-confirm.test.ts

Risks: The confirm must be bound to the person's session and the exact arguments, or it becomes a replay hole.

Fits: a builder, then a sentinel review

Parked by the crew: the check stayed red through 2 automatic tries (pull #7882 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Owner's conductor: reopened pull #7882. Its only red was a merge conflict in docs/MCP.md. Merge main and push, keeping both rows.

Parked by the crew: the check stayed red through 2 automatic tries (pull #7882 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Owner's conductor: reopened pull #7882. Latest red checks: Please fix what is this pull's own and merge main; this piece is what /talk is waiting on.