- Remove palace_path from _no_palace() error response (prevents
  leaking filesystem paths to the LLM)
- Replace str(e) with generic 'Internal tool error' in MCP dispatch
  catch block (full error is still logged server-side via stderr)
- Replace sys.exit(1) with return in searcher.search() CLI function
  (prevents process termination if called from library context)
- Remove unused sys import from searcher.py

Findings: MemPalace#12 (HIGH), MemPalace#5 (MEDIUM), MemPalace#15 (LOW)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

- Remove palace_path from _no_palace() error response (prevents
  leaking filesystem paths to the LLM)
- Replace str(e) with generic 'Internal tool error' in MCP dispatch
  catch block (full error is still logged server-side via stderr)
- Replace sys.exit(1) with return in searcher.search() CLI function
  (prevents process termination if called from library context)
- Remove unused sys import from searcher.py

Findings: MemPalace#12 (HIGH), MemPalace#5 (MEDIUM), MemPalace#15 (LOW)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

…dential

Restores daemon-routing to the committed plugin manifest so JP's fork
main carries the daemon-routed config matching production deployment,
but **without** re-embedding the literal API key.

The previous shape had the key inline:

```json
"env": {"PALACE_API_KEY": "adb43..."}
```

The new shape drops the env block entirely. PALACE_API_KEY is
inherited at runtime from `~/.claude/settings.local.json`'s env block
(which Claude Code passes through to spawned MCP servers and hooks).
That file is gitignored / 0600-perm / per-machine, so the key lives
exactly one place: in JP's local settings, not in any committed source.

Daemon URL and the mempalace-mcp.py client path remain literal —
they're machine-specific identifiers (homelab address + JP's
palace-daemon checkout path), not credentials. They identify *what*
to talk to, not *how to authenticate*.

Anyone forking this repo would rewrite both for their own setup; the
committed values are JP-development-fork defaults, not portable
defaults. The PR-ready shape is what upstream MemPalace's manifest
already uses (`{"command": "mempalace-mcp"}`) — that ships via
contributions to upstream, not via this fork main.

hooks/hooks.json is unchanged (already at upstream-shape after the
earlier scrub) — Claude Code passes the env block to bash hooks too,
so no prelude needed.

Companion to upstream PR #12 (which fixes the same class of
embedded-default in palace-daemon's `clients/palace-mode`).