Add output schemas on hosted MCP tools after the first OpenAI scan

[zachdunn]

Follow-up to #668 / blocked on the first portal scan in #670.

Hosted tools already advertise input schemas, readOnlyHint / openWorldHint / destructiveHint, and OAuth securitySchemes. They do not advertise an outputSchema. OpenAI's submit guide asks for structured outputs after you Scan Tools, so we should implement what the scan actually flags instead of guessing a schema for every tool up front.

Why it waits

The portal is the source of truth for which tools need an output schema and how strict they are. Doing this before the scan is guesswork.

What to do after the scan

• Add outputSchema (or the current SDK equivalent) on the hosted tools the scan names
• Keep stdio and hosted catalogs aligned where the result shape is the same (put, list, comment, …)
• Cover the honest decline shapes on comment (not_installed / not_authorized / forbidden) so a schema does not make those look like thrown errors

What this is not

Not a new tool, not CIMD, not a ChatGPT-only skill rewrite.

[zachdunn]

Opened #673. We went ahead without waiting for Scan Tools: every hosted tool already returns structuredContent, so the schemas follow the live result shapes (including comment declines). The portal scan can still flag extras after identity lands.