Fix MCP read errors and audit rejected calls

[Floating-Y]

Database failures during entity resolution now return explicit MCP tool errors
instead of invalid/unknown entity responses. This also covers graph reads by UUID
and path searches, while preserving existing missing-entity and empty-result behavior.

• Record calls rejected by check_call through the existing mcp.tool_called
  audit path, once per refused or executed call.
• Add regression coverage for read failures, auditing, search limits,
  entity-valued qualifiers, and changes without until.
• Add a dated revision to ADR 0020 and clarify that removing or renaming
  documented structuredContent fields requires a decision record.

No new dependencies or database migrations.

Validation:

• Formatting and workspace Clippy passed.
• Workspace tests against PostgreSQL: 613 passed, 0 failed, 1 ignored.
• All 8 MCP tests passed.
• Frontend production build passed.
• Database tests used UTOPIA_TEST_REQUIRE_DB=1 and 127.0.0.1.

Closes #603.