Workspace attach: use the engine's unfulfilled-keys report instead of diffing declared vs delivered client-side

[ralphstodomingo]

Problem

When a workspace is bound, the CLI announces "N of M declared integration tools available. Declared but not available: …" by fetching the workspace's allowlist from the API and diffing it against the tool names the engine served (engine-overlay.ts, attach path). That diff can only say which keys are absent, never why — an invalid Jira connection, an MCP server whose binary is not installed, an integration the tenant removed from the catalog, an extension tool with no VS Code window, or a key the provider simply does not offer all read the same. It also depends on a second API round-trip at attach time, and it silently drops the engine's own account: @altimateai/datamate 0.7.2 reports every declared-but-unserved key with a reason under _meta["ai.altimate/unfulfilled"] on each tools/list response, and the MCP catalog discards _meta while paginating.

Proposal

• Keep the last tools/list page's _meta per connected server in the MCP catalog and expose it (MCP.listMeta(name)).
• On attach, take the missing set from the engine's report instead of the client-side diff. no-bridge entries stay out of the "missing" line (absent extension tools without an IDE are expected, as today); every other reason is named in the toast and the headless line, grouped by reason with the engine's detail where it has one (for example spawn docker ENOENT).
• Carry the full report on the attached outcome so later surfaces (an inventory with fixes) can use it.
• Raise MIN_ENGINE_VERSION to 0.7.2, the first engine that emits the report. Do not merge before that engine is on npm.

Out of scope

Rendering the report anywhere but the attach toast/headless line; posting the attach outcome to the backend.