Test agent isolation and every queue of the desk tools, and tell agents they see their own sets #2625

Part of #2422 (F-DSK). Follow-up to #2594: findings from an independent review of the merged desk tools. No scoping leak was found in the code. These close test gaps and tighten what agents are told.

Findings

1. Medium: no test that one agent cannot see another agent's sets. The tests only use a person's set as the other party, which the InitiatorKind half of the OpenedBy filter already excludes. The InitiatorId half, the part that separates agents, never runs in a test.
2. Medium: Acceptance only partly covered over MCP. recently_published, reverted and a non-empty stale_facts are never listed through list_desk_queue, and their counts are not asserted. "Appends no event" is not asserted for get_change_set_review.
3. Low: the tool descriptions say "as reviewers see it". An agent reading awaiting_review: 0 may take the desk to be empty while other parties' sets wait.
4. Low: get_change_set_review reads the set and its history separately. A decision that commits between the two reads gives a state that disagrees with the last move until the next call.
5. Low: ChangeSetMoves.Operations repeats the names ChangeSetDirectory appends. No test ties the two, so a new move name would leave the desk dating sets by the previous move.

Scope

• Tests over MCP on SQLite and PostgreSQL:
  • A second agent's sets are not counted, listed or readable.
  • Every queue is listed through the tool with its order and window, and stale facts are listed with paging and the total.
  • No call appends an event.
• The three tool descriptions say an agent sees the change sets it opened.
• get_change_set_review takes the state and rejection reason from the moves it read when they disagree with the set it read, so one answer is consistent.
• An integration test drives a set through every move the directory makes and asserts each appended operation is in ChangeSetMoves.Operations.

Acceptance

• The tests above pass on both providers. A filter that dropped the credential id would fail them.