Add MCP tool profiles for workspace chat flows

Expose stable MCP/server tool profiles so chat hosts can start narrow and widen only when needed. This adds vm-run, workspace-core, and workspace-full across the CLI serve path, Pyro.create_server(), and the package-level create_server() factory while keeping workspace-full as the default.

Register profile-specific tool sets from one shared contract mapping, and narrow the workspace-core schemas so secrets, network policy, shells, services, snapshots, and disk tools do not leak into the default persistent chat profile. The full surface remains available unchanged under workspace-full.

Refresh the public docs and examples around the profile progression, add a canonical OpenAI Responses workspace-core example, mark the 3.4.0 roadmap milestone done, and verify with uv lock, UV_CACHE_DIR=.uv-cache make check, UV_CACHE_DIR=.uv-cache make dist-check, and a real guest-backed workspace-core smoke for create, file write, exec, diff, export, reset, and delete.

docs/public-contract.md

@@ -82,6 +82,7 @@ Behavioral guarantees:
 - `pyro workspace create --seed-path PATH` seeds `/workspace` from a host directory or a local `.tar` / `.tar.gz` / `.tgz` archive before the workspace is returned.
 - `pyro workspace create --name NAME --label KEY=VALUE` attaches human-oriented discovery metadata without changing the stable `workspace_id`.
 - `pyro workspace create --network-policy {off,egress,egress+published-ports}` controls workspace guest networking and whether services may publish localhost ports.
+- `pyro mcp serve --profile {vm-run,workspace-core,workspace-full}` narrows the model-facing MCP surface without changing runtime behavior.
 - `pyro workspace create --secret NAME=VALUE` and `--secret-file NAME=PATH` persist guest-only UTF-8 secrets outside `/workspace`.
 - `pyro workspace list` returns persisted workspaces sorted by most recent `last_activity_at`.
 - `pyro workspace sync push WORKSPACE_ID SOURCE_PATH [--dest WORKSPACE_PATH]` imports later host-side directory or archive content into a started workspace.
@@ -125,8 +126,8 @@ Primary facade:
 
 Supported public entrypoints:
 
-- `create_server()`
-- `Pyro.create_server()`
+- `create_server(profile="workspace-full")`
+- `Pyro.create_server(profile="workspace-full")`
 - `Pyro.list_environments()`
 - `Pyro.pull_environment(environment)`
 - `Pyro.inspect_environment(environment)`
@@ -176,7 +177,7 @@ Supported public entrypoints:
 
 Stable public method names:
 
-- `create_server()`
+- `create_server(profile="workspace-full")`
 - `list_environments()`
 - `pull_environment(environment)`
 - `inspect_environment(environment)`
@@ -265,6 +266,18 @@ Behavioral defaults:
 
 ## MCP Contract
 
+Stable MCP profiles:
+
+- `vm-run`: exposes only `vm_run`
+- `workspace-core`: exposes `vm_run`, `workspace_create`, `workspace_list`, `workspace_update`, `workspace_status`, `workspace_sync_push`, `workspace_exec`, `workspace_logs`, `workspace_file_list`, `workspace_file_read`, `workspace_file_write`, `workspace_patch_apply`, `workspace_diff`, `workspace_export`, `workspace_reset`, and `workspace_delete`
+- `workspace-full`: exposes the complete stable MCP surface below
+
+Behavioral defaults:
+
+- `pyro mcp serve` and `create_server()` default to `workspace-full`.
+- `workspace-core` narrows `workspace_create` by omitting `network_policy` and `secrets`.
+- `workspace-core` narrows `workspace_exec` by omitting `secret_env`.
+
 Primary tool:
 
 - `vm_run`