MCP servers can now request structured user input mid-task via the
Elicitation protocol. The agent routes ElicitationRequest events to
the active channel at turn boundaries via a non-blocking drain loop.

- CLI channel: interactive prompt with server name attribution and
  field-by-field input collection; supports string, boolean, integer,
  number, and enum field types with type coercion and validation
- Non-interactive channels (TUI, Telegram, daemon, scheduler):
  auto-decline with a logged warning
- Sandboxed trust level: elicitation is unconditionally blocked
- Per-server override: `elicitation_enabled` in [[mcp.servers]] takes
  precedence over the global `[mcp] elicitation_enabled` setting
- Timeout: configurable `elicitation_timeout_secs` (default 120s)
- Phishing prevention: server name always shown before any prompt;
  message sanitized (control chars stripped, 500-char cap via
  char-level truncation to avoid UTF-8 boundary panics)
- Input validation: invalid input declines gracefully with a message
  rather than storing a wrong-type value

Known limitation: elicitation arriving during MCP tool call execution
times out because the agent loop is blocked; tracked as phase-2 work.

9 new tests: sanitize_elicitation_message (control chars, cap,
multi-byte boundary), build_elicitation_fields (type mapping, required
flag), sandboxed trust blocks elicitation, elicitation_enabled gate.
6980/6980 tests pass.