The outsiders switch over the API and MCP, an admin's alone #792

Closes #755

"Outsiders may trigger the crew" (repo.crewOutsiders, off by default, from #619) can now be set outside the web form: over the JSON API and over MCP.

• API: PATCH /api/v1/repos/:owner/:name accepts crewOutsiders: boolean. It goes through the same updateRepoSettings as the web form, needs an admin token, and is recorded as repo.crew_outsiders. I added it to the existing settings route rather than a new crew-settings route, so a repository's settings keep one door.
• MCP: a new tool, outsiders { repo, on?, dryRun? }.

- Without on, it says which way the switch is set. - With on, it only plans unless you send dryRun: false. - Setting it needs an admin of the app and an admin token.

• Agents are refused, in the action itself: an agent never changes who the crew obeys, even an agent on the team that administers the repository.
• The map and audit say which way it is set.

- The map JSON (API and the MCP map tool) and the MCP audit tool carry crewOutsiders. - The map page's autonomy line says "only writers direct the crew" or "anyone signed in directs the crew". With autonomy off, it shows the outsiders note only when the switch is on.

• Docs: docs/MCP.md lists the new tool.

Tests are in test/outsiders-switch.test.ts, added to the gate list:

• Over the API and over MCP (both planning and setting), a writer who is not admin, a reader, and an agent on the owners' team are each refused.
• The admin's change is recorded.
• An admin with an rw token cannot set it.
• The map and audit report the switch.
• With the agent refusal removed, the two refusal tests fail.

🤖 Generated with Claude Code