MCP server returns cross-project symbols — no project scoping for workspace index

[ajianaz]

Problem

When cora index is run inside a Cargo workspace (e.g., /opt/data/cora-api which contains crates/cora-*, crates/uteke-*, crates/nginjen-*), the index includes all crates in the workspace. The MCP server (cora mcp) then returns symbols from all projects, not just the project being worked on.

Reproduction

# In /opt/data/cora-api (Cargo workspace with cora-api, uteke, nginjen crates)
cora index
# → Indexed 592 symbols from 237 files

# MCP search returns foreign crate symbols
# cora.search_symbols query='generate'
# Returns: generate_memories from uteke-cli/src/bench.rs
# Expected: generate from cora-auth/src/api_key.rs

Expected Behavior

MCP server should scope symbol search to the current project (where cora mcp was started or where .cora.yaml lives). Options:

1. Project root detection — MCP server should detect project root from .cora.yaml or Cargo.toml location, not from CWD
2. --project-root flag on cora mcp to explicitly set scope
3. Workspace member filtering — for Cargo workspaces, allow ignore patterns in .cora.yaml to exclude foreign crates

Actual Behavior

MCP server CWD = /opt/data (home dir), not /opt/data/cora-api. All cora.* MCP tools search the entire workspace index without project scoping.

Environment

• cora 0.8.1
• Cargo workspace at /opt/data/cora-api with 3 projects: cora-api, uteke, nginjen
• MCP server started from /opt/data (Hermes agent default CWD)
• Index DB: /opt/data/.codecora/cora-code/graph.db (shared across all projects)