fix(mcp): hand a call's warnings to the agent

idx-core reports what it works around (history falling back to yahoo when
Stockbit refuses the session, a stale cache served after a failed fetch, a
movements query cut short) as warnings on stderr. An agent never reads
idx-mcp's stderr, so it saw `source: "yahoo"` or `stale: true` with no reason.

- Each tool call collects its warnings with runtime::on_warning and returns
  them as `warnings` on the answer or the error, when there are any.
- The stale-cache warning names the failure behind it.
- The mock's session API 403 is the real session API's block message; the
  public page's block names IDX_PROVIDER=msn as well as `--provider msn`.

Goldens: error-intraday-blocked (json, table) carry the reworded block hint.

Claude-Session: https://claude.ai/code/session_01RqPPVeVDrnLoP7NUZmLRxY

docs/DESIGN.md

@@ -93,7 +93,9 @@ Key decisions:
 - **`Fetched<T>` envelope** for live data: `{ data, source, fetched_at, stale }`,
   so agents and API clients can see freshness. idx-core still emits the
   stale-cache warnings through `runtime` (which `set_quiet` silences) so CLI
-  stderr stays identical.
+  stderr stays identical. idx-mcp also catches a call's warnings with
+  `runtime::on_warning` (the call runs on one blocking thread) and returns
+  them as `warnings`, since an agent never reads the server's stderr.
 - **`CachePolicy`**: `Default | Offline | Refresh` replaces the `--offline` /
   `--no-cache` flag handling now spread through `cli/stocks.rs`.
 - **Explicit configuration.** `CoreConfig::load()` is the one place idx-core reads