fix(mcp): enforce trusted workspace root

[cursor]

Bug and impact

The new sandbox read_workspace_file / write_workspace_file tools accepted a caller-supplied workspace_root. MultiMCP only filled the trusted trace workspace when the argument was absent, so a model-produced tool call could redefine the sandbox root and read or overwrite files outside the intended ClawBench workspace.

Root cause

workspace_root was treated as a public tool argument instead of a trusted routing value. The router used setdefault, leaving hostile or mistaken caller-provided roots intact.

Fix

MultiMCP.route_tool_call now overwrites workspace_root with the trace-scoped workspace for workspace file tools whenever a trusted workspace is present.

Validation

• python3 -m pytest tests/test_mockehr_mcp.py -q