- Share cursor decoding in foundation.decode_offset_cursor so both tools
reject an invalid cursor identically, before any upstream call.
- Add regression coverage that a malformed repo slug (owner/repo/extra,
missing owner, empty segment) is refused before any network call.
- Add evidence that BOTH project context tools inherit the shared MCP
client audit record and untrusted-content fence, instead of each tool
shipping its own. No audit subsystem is duplicated.
thanhnv