Brief: S3-D2 — close the contract (description)

Pre-staged during S3-D1's run. The probe answered Open Question 1 "surfaces today" — no runCommand fix; this dispatch is the description sentence plus final gates.

Task

Update the migrate-reset tool description in packages/cli/src/mcp/MCP.ts to tell agents the command is gated for AI agents and that, when blocked, the returned error text contains the consent protocol to relay verbatim to the user (note the text arrives after execa's "Command failed with exit code 1: <command>" prefix — word the sentence so an agent isn't surprised by that framing). Review the other three tool descriptions for one-pass consistency only if a trivially small wording touch keeps them coherent — no behavioral changes anywhere.

Completed when

• The migrate-reset description names the AI-agent gate and instructs relaying the consent protocol from the error text; zod schema and behavior untouched.
• mcp-safety.vitest.ts still green (the description change must not break the pinned contract); packages/cli pnpm run tsc green; eslint on the touched file green.
• Captured: the final migrate-reset tool listing (name + description) as an MCP client sees it (tools/list via the SDK client), for the PR description.

Constraints (terse)

One commit; explicit staging; no push; heartbeats as usual.

• Time-box: 20 minutes.
• Halt conditions: anything beyond description strings turns out to be needed.