fix: remove duplicate state scan, dead safety fallback, and align MCP cost ratios

[fix2015]

Summary

• Remove duplicate STATE.md in stateCandidates: STATE_FILES already includes 'STATE.md', so spreading it and appending 'STATE.md' again caused the file to be scanned twice. Changed to just [...STATE_FILES].

• Remove dead safety doc fallback: SAFETY_FILES already contains 'docs/safety.md', so the fallback check await fileExists(path.join(root, 'docs', 'safety.md')) after iterating SAFETY_FILES was unreachable dead code. Removed the redundant block.

• Align MCP server cost mix ratios with the canonical estimator: The hardcoded mix ratios in the MCP server's cost estimate tool diverged from realisticMix() in tools/loop-cost/src/estimator.ts. Updated L1 from noop: 0.7, report: 0.3 to noop: 0.6, report: 0.4, and L2 from noop: 0.6, report: 0.25, action: 0.15 to noop: 0.5, report: 0.3, action: 0.2 to match the estimator's canonical non-early-exit values.

Test plan

• Verify stateCandidates no longer contains duplicate STATE.md entries
• Confirm safety doc detection still works correctly via the SAFETY_FILES loop
• Confirm MCP server cost estimates now match the standalone estimator for L1 and L2 levels