fix: bound MCP history responses

[vycdev2]

Summary

• Bound read-message-history MCP responses with the new MCP_HISTORY_MAX_CHARS setting (default 120,000; maximum 1,000,000).
• Retain the newest matching history and include an explicit truncation note when the response exceeds the configured limit.
• Added regression coverage, configuration validation, documentation, and changelog entry.

Verification

• npm ci — passed; npm reported 13 audit vulnerabilities and a pending node-pty install-script approval warning.
• npm run build — passed.
• node --test --test-name-pattern='bounds read-message-history responses' tests/mcpHistoryOutput.test.mjs — RED on untouched upstream/main because the oversized response exceeded 120,000 characters; GREEN after the fix.
• node --test tests/configLimits.test.mjs tests/mcpHistory.test.mjs tests/mcpHistoryOutput.test.mjs — passed (8 tests).
• npm test — passed (66 tests).
• node --input-type=module -e "const p=await import('node-pty'); console.log(typeof p.spawn)" — passed (function).
• git diff --check upstream/main...HEAD — passed.
• No linter is configured in the repository.

Risk

Low. Only the MCP history response assembly is bounded; the newest matching history is retained, normal-sized responses are unchanged, and the limit is operator-configurable within a safe maximum.

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.