docs: note in-place mutation contract on _with_optional_url

Subagent review (read-only) found no blockers; this addresses its one
LOW note by documenting that the helper mutates the passed dict and
must receive a freshly-built one.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

mcp_server.py

@@ -56,7 +56,11 @@ def _reveal_endpoints() -> bool:
 
 
 def _with_optional_url(result: dict, url: str | None) -> dict:
-    """Attach web links only under the explicit endpoint reveal opt-in."""
+    """Attach web links only under the explicit endpoint reveal opt-in.
+
+    Mutates *result* in place and returns it; pass a freshly-built dict,
+    never a shared/aliased one.
+    """
     if _reveal_endpoints() and url:
         result["url"] = url
     return result