Add interactive service session replies

[edwin-zvs]

Summary

• add headless/interactive service session mode for Codex and Claude
• inject a session-bound construct_service_reply MCP tool and correlate one-shot delivery IDs
• keep Slack credentials, allowlists, destination, and thread binding in the existing channel adapter
• preserve general/plugin MCP access only when the service explicitly grants it
• add the service editor picker and normative protocol spec

Validation

• cargo test -p construct-protocol -p construct-daemon -p construct-mcp
• CLI suite: 1321/1322 passed under ambient NO_COLOR=1; the sole color-capability test passed when rerun with NO_COLOR unset and truecolor enabled
• focused interactive service, MCP catalog, adapter environment, and service editor tests
• cargo build
• git diff --check

Notes

The official Slack MCP can still be available when general MCP is granted, but service delivery uses the transport-neutral bound reply tool so models cannot override the configured Slack workspace, channel, thread, or credentials.