display_message exposes arbitrary tmux format job evaluation as readonly

[tony]

Problem

display_message is exposed as a readonly tool and accepts arbitrary tmux format strings. tmux format strings can include #(...), which schedules shell jobs.

This makes the tool broader than a safe readonly metadata query. Even when one-shot clients can race with job cleanup, the tool still exposes tmux's shell-job evaluator through the readonly tier.

Minimal local reproduction

Use verbose tmux logs and a benign local command:

$ sock=libtmux_mcp_display_$$
$ tmp=$(mktemp -d)
$ tmux -vvv -L "$sock" -f /dev/null new-session -d -s s "sleep 30"
$ tmux -L "$sock" display-message -vp -t s:0.0 "#(printf ok > $tmp/marker)"
$ rg "found #\\(\\)|job_run" "$tmp" -g "*.log"
$ tmux -L "$sock" kill-server

Expected today: tmux logs show found #() and job_run.

Upstream mechanism

• display-message expands the provided template: https://github.com/tmux/tmux/blob/3.6a/cmd-display-message.c#L140
• tmux detects #(...) format jobs: https://github.com/tmux/tmux/blob/3.6a/format.c#L5566-L5573
• tmux executes jobs through /bin/sh -c: https://github.com/tmux/tmux/blob/3.6a/job.c#L185

Minimal fix

Do not expose arbitrary tmux format evaluation as readonly.

Preferred minimal path:

• Keep a safe readonly tool for common format variables using an allowlist.
• Move arbitrary display_message(format_string=...) to the mutating tier or reject #(...).

Acceptance criteria

• No readonly tool can invoke tmux #(...) format jobs.
• Common safe metadata queries still work through an allowlisted readonly path.
• Tests cover allowed variables and rejection of #(...).