fix(cloud): signing mcp cloud only

[tatoalo]

Problem

local signing MCP tool must be only tied to cloud runs. it wasn't. now it is.

[greptile-apps]

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
packages/agent/src/adapters/local-tools/registry.ts:20-24
`taskRunId` is no longer used in any tool gate — `isCloudRun` was the only consumer and it now reads `environment` instead. Keeping the field in `LocalToolGateMeta` contradicts the "minimal shape needed to gate tools" doc comment and the simplicity rule of no superfluous parts. Removing it makes the contract clear: only `environment` signals cloud/local for gating purposes.

```suggestion
/** Minimal session-meta shape needed to gate tools (e.g. cloud-only). */
export interface LocalToolGateMeta {
  environment?: "local" | "cloud";
}
```

_{Reviews (1): Last reviewed commit: "fix(cloud): signing mcp cloud only" | Re-trigger Greptile}

[Piccirello]

Very low context stamp