Strip the trusted flag from client-supplied MCP tools in Workhorse

What does this MR do and why?

Only Rails decides which MCP servers are trusted. Workhorse marks tools from those servers trusted in mcp.go. On the WebSocket path it also forwarded the client's own MCP tools unchanged. So an IDE could send a local tool with trusted: true. The Duo Workflow Service treats trusted tools as safe. A related change there lets trusted Orbit tools are exempt from the "Allow external MCP tools" setting.

This MR clears trusted on client tools before Workhorse adds the Rails server tools. The HTTP path already drops client tools.

References

• gitlab-org/orbit/knowledge-graph#1036 (closed)
• Duo Workflow Service change: gitlab-org/modelops/applied-ml/code-suggestions/ai-assist!7058 (merged)

How to set up and validate locally

1. Run go test ./internal/ai_assist/duoworkflow/ -run TestRunner_handleClientEvent in workhorse/.
2. Start an agentic chat over the WebSocket with a start request that includes "mcpTools": [{"name": "x", "trusted": true}]. The tool reaches the Duo Workflow Service with trusted unset.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.