fix(lp1): tailor remediation to manifest type

[green3sf]

Closes #300.

What changed

• Make LP1 remediation follow the declaration source:
  • Agent Skills using allowed-tools are told to add a tool that covers the missing capability.
  • MCP server manifests using permissions are told to add the missing capability to that list.
• Align the LP1 fallback remediation and the B.3.1 design documentation.
• Add regression assertions for both manifest shapes.

Why

LP1 currently tells Agent Skills authors to add a generic permission to SKILL.md, but the Agent Skills schema uses allowed-tools. Following the existing remediation can therefore produce an unsupported field and leave the finding unresolved.

PR #316 corrected the same guidance gap for LP3. This completes the remaining LP1 path described in #300 without changing detection, scoring, or schema behavior.

Validation

• ruff check on the changed Python and test files
• ruff format --check on the changed Python and test files
• Python AST parsing for the changed Python and test files
• git diff --check

The focused regression assertions are included; the repository's full dependency-backed test suite is left to GitHub Actions to avoid installing its unrelated AI/AWS runtime stack locally.

[rng1995]

[SkillSpector Review]

Approved. LP1 remediation now follows the declaration shape actually in use: Agent Skills receive allowed-tools guidance and MCP manifests receive permissions guidance. The runtime fallback, defaults, documentation, and regressions are aligned; required CI is green.