Claim links stay out of an agent's conversation unless revealed on purpose #941

Closes #839

A child's claim link is a live secret, and it now stays out of an agent's conversation unless someone asks for it there on purpose.

• Choice: keep it out, plus an on-purpose reveal. I did not add a readable-once GET. Storing a live link on the parent would be one more place to take it from, and re-issuing already hands a person a fresh link in their own browser.

- MCP spawn makes the child and answers without claimUrl. It says that a person admin gets a fresh link on /forges ("Send a fresh link") and hands it over. - MCP claim_link changes nothing without reveal: true. Without it, the tool would kill the person's current link for a new one nobody sees. - Both tools take reveal: true to put the link in the conversation, and the answer then says plainly that it is a live secret. - The plain API (POST /api/v1/forges, POST /api/v1/forges/:name/claim-link) is unchanged: whoever calls it chose to receive the link.

• The path form /claim/:token is kept, with a date. Links are minted in the fragment form only since #836 (merged 2026-10-05 23:52Z), and a link lives 24 hours. Until the first release containing #836 has run for 24 hours, a live path link can exist. docs/SPAWN.md says so; #937 owns the removal.
• Who may re-issue: docs/SPAWN.md and the claim_link description now say any site admin of the parent, not only the spawner.

Tests:

• test/spawn-api: MCP spawn without reveal has no claimUrl and no /claim#; with reveal it has the link and the secret warning.
• test/claim-link: MCP claim_link without reveal re-issues nothing (reissued: false, no link); with reveal it returns a link and says it is a live secret; a read-only token is refused.
• The path form's existing tests (spawn-first-boot, spawn-child-apps) still pass.

Done means reachable: the MCP tools, the API, the /forges button (unchanged), tests and docs. No new page.

🤖 Generated with Claude Code