fix(mcp): emit trace evidence columns in header order

[rudi193-cmd]

What does this PR do?

The original #1542 json omission landed in v0.10.3. Two leftovers remained on main:

1. bfs_to_tree_json declared strategy, confidence before args but emitted args first, so json + include_evidence + data_flow mislabeled columns (len(cols)==len(row) still held).
2. Tree flat_trace (risk_labels or data_flow) called bfs_to_toon_table without include_evidence, so evidence was a silent no-op on that branch.

This PR emits cells in header order and forwards the flag into the flat table. Tests assert column identity, not just count.

Not folding in #1597 budget signalling.

Checklist

• Every commit is signed off (git commit -s) — required, CI rejects
  unsigned commits (DCO, see CONTRIBUTING.md)
• Tests pass locally (scripts/test.sh --suites mcp)
• Lint passes (make -f Makefile.cbm lint-ci)
• New behavior is covered by a test (reproduce-first for bug fixes)

Fixes #1542

Made with Cursor

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[DeusData]

Thank you for the focused follow-up to #1542. This is the right review shape: one output-contract defect, two production branches, and tests that bind column identity rather than merely row width. The initial patch scan found no new dependency, execution, network, or configuration surface. It is labeled high priority because silently mislabeling trace evidence is a correctness bug. The review queue is full, but this contribution is now routed as a compact bug fix.