stack: MCP submit-Tool mit Upload Review Gate und Quarantäne-Schreibpfad (schliesst #32)

Files changed:
- .gitignore
- AGENTS.md
- CHANGES.md
- INSTALL-MCP.md
- README.md
- VERSION
- docs/why-gates-are-code.md
- instructions/gates.md
- instructions/ingest-queue.md
- instructions/mcp-read-server.md
- instructions/wiki-ingest/SKILL.md
- raw/CONTRACT.md
- tools/CONTRACT.md
- tools/chemenu/cli.py
- tools/chemenu/commands/docs_verify.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/commands/upload_cmd.py
- tools/chemenu/config.py
- tools/chemenu/mcp/server.py
- tools/chemenu/tests/test_doctor.py
- tools/chemenu/tests/test_mcp_server.py
- tools/chemenu/tests/test_upload.py
- tools/chemenu/tests/test_upload_cmd.py
- tools/chemenu/upload.py

.gitignore

@@ -125,6 +125,14 @@ npm-debug.log*
 # which.
 /.wikitool-telemetry.json
 
+# MCP `submit` tool opt-in (identity header name, size deckel, extension
+# allowlist, per-submitter quota - see raw/CONTRACT.md "Getting a file in
+# from outside" and tools/chemenu/upload.py). Per-checkout for the same
+# reason as the two files above. Absent means the tool is not registered at
+# all - not "unrestricted" - the stronger of the two postures this file
+# co-locates with.
+/.wikitool-upload.json
+
 # Coverage output from `pytest --cov` (see .gitea/workflows/ci.yml). Derived,
 # like reports/: recomputable from any commit, and `publish` runs `git add -A`,
 # so an unignored htmlcov/ would commit itself on the next content publish.
@@ -152,6 +160,16 @@ npm-debug.log*
 # by the content backstop below.
 /incoming/
 
+# MCP `submit` tool quarantine (see raw/CONTRACT.md "Getting a file in from
+# outside" and tools/chemenu/upload.py). Material pushed by a caller that is
+# not this terminal, before a human has reviewed any of it - stronger than
+# `incoming/` above: not merely uncommitted, but read by no command in the
+# ordinary pipeline. No `.gitkeep`: the directory is created on demand by
+# the one function that is allowed to write into it, and a checkout that
+# never arms the `submit` tool never gets one. Never anchored back open by
+# the content backstop below, same as `incoming/`.
+/mcp-upload/
+
 # Content backstop - keep this block last. Nothing under raw/, kb/ or work/ may
 # be excluded by a pattern above; see the header note for why directory patterns
 # still have to be anchored rather than relying on these negations.