fix(mcp): apply the message-id format rule on the agent tool

[rmyndharis]

MarkChatReadDto rejects a whitespace-only entry in messageIds, but SessionMarkChatRead declared its own list and copied only the count bound. invokeTool parses the tool's schema and calls the service directly, so the DTO never applies on that path and [' '] reached the engine as a receipt key.

What changed

• The pattern and its rejection message become exported constants beside the existing cap, and the agent tool holds them instead of restating the rule. Restating it is how the two surfaces drifted.
• One test drives the real invokeTool path and asserts the service is never reached, since a 400 that still delegated would leave the defect in place. A well-formed id is sent through as the control.

Also in this PR

The [Unreleased] changelog entries had grown past anything the released sections carry: median 44 words against 34, longest 139 against a historical maximum of 80. They are rewritten to the same distribution (median 39, longest 57), keeping what a reader acts on. Contributor credit and the section headings are unchanged. Bundled here rather than split off because it is prose only and touches no code.

Verification

• Removing the regex fails the new test alone; loosening the shared constant fails four tests across both surfaces, which is what shows the rule is shared rather than copied.
• npm run build, npm test, npm run lint, npm run format:check, test:docs, test:scripts, and the openapi, SDK and contract gates. check-contract-shapes reports 320 pairs, unit 5851 tests.

Fixes #1405