Claim links: keep the live link out of an agent's conversation, retire the path form, and say who may re-issue #839

Pillar: P4 Forge in a link (#590). One run. Follow-ups from the review of pull #836 (#729, #730); start after #836 merges.

Outcome. A claim link, a live secret, stays out of an agent's conversation unless someone asks for it there on purpose. The old link form is retired once no live link uses it. The docs say exactly who may re-issue a link.

Acceptance.

• [ ] MCP spawn and claim_link stop returning the live claimUrl by default. They return the child and say the link is waiting at GET /api/v1/forges/:name/claim-link, readable once with a person's session or token. Alternatively they carry a plain warning that the link is a secret now in this conversation; the pull states which choice it makes and why. Test.
• [ ] GET/POST /claim/:token (the path form from before #730) is removed once no unclaimed child holds a token minted for a path link. Or it is kept with a dated note in docs/SPAWN.md and an owning issue, if links of that form can still be live. Test either way.
• [ ] docs/SPAWN.md and the MCP description say "any site admin of the parent" may re-issue, not only "the spawner".
• [ ] Done means reachable: the API and the MCP tool, tests, and docs. No new page.

Start from: src/http/mcp.ts (spawn, claim_link), src/spawn/door.ts, src/web/pages/claim.ts, src/http/server.ts, docs/SPAWN.md, scratchpad verdict 836.

Must not touch: the release workflow, the chart, other repositories.