stack: MCP submit-Tool mit Upload Review Gate und Quarantäne-Schreibpfad (schliesst #32)

Files changed:
- .gitignore
- AGENTS.md
- CHANGES.md
- INSTALL-MCP.md
- README.md
- VERSION
- docs/why-gates-are-code.md
- instructions/gates.md
- instructions/ingest-queue.md
- instructions/mcp-read-server.md
- instructions/wiki-ingest/SKILL.md
- raw/CONTRACT.md
- tools/CONTRACT.md
- tools/chemenu/cli.py
- tools/chemenu/commands/docs_verify.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/commands/upload_cmd.py
- tools/chemenu/config.py
- tools/chemenu/mcp/server.py
- tools/chemenu/tests/test_doctor.py
- tools/chemenu/tests/test_mcp_server.py
- tools/chemenu/tests/test_upload.py
- tools/chemenu/tests/test_upload_cmd.py
- tools/chemenu/upload.py

AGENTS.md

@@ -117,7 +117,7 @@ Four pages exist today, each read by link rather than automatically:
 [docs/pipeline-rationale.md](docs/pipeline-rationale.md) (why the pipeline has four stages),
 [docs/ownership-and-templates.md](docs/ownership-and-templates.md) (why a `.template` split
 exists, and why silent overwrite is the failure it guards against),
-[docs/why-gates-are-code.md](docs/why-gates-are-code.md) (why the three gates in
+[docs/why-gates-are-code.md](docs/why-gates-are-code.md) (why the four gates in
 [Gates](#gates) are code rather than instruction), and
 [docs/version-model.md](docs/version-model.md) (why a version number answers a compatibility
 question and a migration question separately).
@@ -219,7 +219,7 @@ tools/wikitool search --field entity_type=system --field '!sources'
 
 ## Gates
 
-Three limits are enforced in code rather than by instruction, because a prompt-level limit is
+Four limits are enforced in code rather than by instruction, because a prompt-level limit is
 one an agent can talk itself past.
 
 - **Mass-Update Gate.** `publish` exits **42** on a change touching too many files, printing
@@ -228,6 +228,9 @@ one an agent can talk itself past.
 - **Publish-Remote Gate.** `publish` exits **42** on a push to a URL this checkout has not
   declared in `.wikitool-remotes.json`. It has no token and no flag: the way past it is a
   deliberate edit by the user, never by an agent.
+- **Upload Review Gate.** `upload accept` exits **42** on an MCP `submit` tool submission
+  nobody has cleared yet, printing its manifest and the `--confirm <token>` line that promotes
+  it once the user approves - same shape as the Mass-Update Gate, one submission at a time.
 - **Iteration Budget Gate / Loop-Breaker.** Past 60 `wikitool` calls in a session, or after 3
   identical calls in a row, further calls are refused.