Require explicit opt-in for embedded MCP fallback

[zzet]

Summary

• require explicit machine-global mcp.allow_embedded: true before gortex mcp may start the legacy one-shot embedded server
• default to a clear error when no compatible daemon is available, preventing multiple MCP clients from silently creating duplicate indexers
• fail closed on malformed global config and prevent repository-local .gortex.yaml from granting this machine-level permission
• preserve --proxy as daemon-only, surface permission/broken-socket failures, and prevent cancellation from falling through to embedded startup
• document the new default and expose it in the generated global config template

Opt in to legacy behavior

# ~/.gortex/config.yaml
mcp:
  allow_embedded: true

Without this setting, users should start the shared daemon with gortex daemon start.

Testing

• go test -race -timeout=20m ./... (clean normal clone with isolated user/daemon state)
• go build ./cmd/gortex/... ./internal/daemon/...
• go test -race ./cmd/gortex/... ./internal/daemon/...
• make lint
• git diff --check origin/main...HEAD

Follow-up to #418.