deps: bub-mcp 0.3.1+ makes remote MCP tools deferred, blocking the pin update #78

What problem are you trying to solve?

Landing pins bub-mcp==0.3.0. Every later release changes how remote MCP tools reach the model, so the pin cannot move as a routine bump:

• bub-mcp 0.3.1 adds MCPSettings.deferred_tools: bool = True and passes deferred=self.settings.deferred_tools when it builds a remote tool.
• bub-mcp 0.3.2 and 0.4.0 keep that default. 0.4.0 also renames MCPChannel to MCPManager (leaving MCPChannel = MCPManager), changes bind_agent to take BubAgent, drops the channel lifecycle in favor of provide_tools/provide_lifespan, and adds its own mcp list tool.

Bub 0.6.1's BubAgent.prepare_tools keeps deferred tools out of the direct tool list, lists them in a <deferred_tools> prompt section, and exposes tool.describe as the only way to load one. In Landing that means a configured server's mcp_<server>_<tool> is no longer callable directly.

Reproduced on a branch that pins bub-mcp==0.4.0 (bub 0.6.1): uv run python -m pytest tests/test_mcp.py fails with bub.errors.BubError: [tool] Unknown tool name: mcp_evidence_record. after the model calls the tool name it uses today, and uv run ty check reports src/landing/mcp.py:54 passing Agent where bub-mcp 0.4.0 declares BubAgent. The rest of the suite is untested past that first failure.

Adopting the newer bub-mcp therefore changes released MCP behavior in docs/reference/configuration.md: tools stop appearing in the model's tool list and the model has to discover them through tool.describe. AGENTS.md asks for released public behavior to be preserved unless a change is authorized, which is why #77 bumps Bub alone and leaves bub-mcp at 0.3.0.

What would a useful result look like?

A maintainer decision on which MCP behavior Landing should ship, and then the matching dependency bump:

• Keep direct MCP tools: pin bub-mcp at a release with deferred_tools disabled for Landing's channel, or set the bub-mcp setting to false from Landing's configuration. Acceptance: an MCP tool from a configured server is callable by name without a discovery step, and tests/test_mcp.py passes on the newer bub-mcp.
• Adopt deferred MCP tools: bump to bub-mcp==0.4.0, import MCPManager, pass BubAgent to bind_agent, and cover the discovery flow in the mode prompts and docs/reference/configuration.md. Acceptance: a task can list and load a remote MCP tool through the supported tooling, and the MCP tests exercise that path instead of a direct call.

Either way the pin should move only after the corresponding behavior is covered, so the next uv lock --upgrade does not silently change MCP behavior.

Additional context

Evidence comes from the dependency maintenance run that produced #76 (lockfile refresh) and #77 (Bub 0.6.1). No Dependabot or code-scanning alert is open for this repository, so nothing forces the bub-mcp bump; this is a policy decision rather than a security fix.