feat(mira): expose complete public API catalog

[JedIV]

What changed

• Add get_mira_api_capabilities to discover the fixed MIRA public API catalog.
• Add call_mira_api to execute catalogued operations with strict path, query, payload, and download validation.
• Cover 61 MIRA operations across infrastructures, agents, operations, risk, settings, business KPIs, topic families, tags, monitoring thresholds, and native alert evaluation.
• Add agent threshold context reads and revision-aware partial updates: custom warning/critical levels, disabling, inheritance, and explicit override resets. Unnamed metrics and unrelated agent configuration are preserved by the matching backend implementation.
• Expose the existing filtered native alert evaluator; evaluation is a mutation and its count is evaluated agents, not newly created alerts.
• Add operator guidance, capability documentation, tool registration, tests, Apache headers, and Headless 0.6 tool metadata.

Why

MIRA exposes a broad, regular action-oriented API. A fixed catalog plus one constrained dispatcher keeps the MCP tool surface small while preventing arbitrary paths or HTTP methods. Threshold controls let Headless configure native monitoring without browser-session credentials or generic agent-setting replacement.

Impact

Agents can inspect and administer MIRA through two discoverable Headless tools. JSON, multipart evidence upload, revision-aware mutation workflows, and safe binary downloads are supported. Existing Headless tools are unchanged.

Compatibility

The branch includes current main's shared authentication/executor refactor. MIRA operations preserve request-scoped identity across stdio and HTTP; local-file risk evidence upload/download is blocked in HTTP mode to protect the MCP host filesystem. The two monitoring-threshold operations require a DIP build exposing GET/PUT /publicapi/dam/infras/{infraId}/agents/{agentId}/monitoring-thresholds. This backend extension has been implemented and verified locally, but is not included in this Headless PR and is not assumed available in stock releases. The catalog describes client support, not live server capability detection; unsupported servers can return 404. No fallback to internal UI APIs is attempted.

evaluate_mira_alerts requires the native public POST /publicapi/dam/agents/actions/evaluate-alerts endpoint. Empty agent filters evaluate all writable agents; the operator guide requires reviewing the selected scope first.

Validation

• uv sync --locked
• Python compilation for all dataiku_mcp sources
• uv run cz check --rev-range origin/main..HEAD
• uv run pytest — 470 passed
• uv run pre-commit run --all-files --show-diff-on-failure
• uv lock --script runtime/run_mcp.py --check
• uv build — sdist and wheel built successfully; isolated wheel import smoke passed
• All GitHub checks pass, including Python 3.10–3.14, packaging, pre-commit, license headers and PR title (run 35066697054).
• Live stdio MCP smoke using the locked runtime and normal API-key authentication against the matching local DIP build: threshold discovery/read, targeted partial update, read-back, stale-revision rejection, and evaluation of one explicitly selected agent.
• Verified the native evaluator created a warning from an existing completed-day observation, with native source/history. Unrelated agent settings and permissions were preserved; the expected native discovered-to-managed transition occurred.
• Matching local DIP backend: 125 focused alert/Cobuild/API tests passed. No remote DIP deployment is part of this PR.
• After the main-branch compatibility update, repeated the locked stdio startup and live public threshold read successfully.