fix(mcp): make explore cross-context dedup opt-in

[danusha2345]

Summary

Fixes #1620.

An MCP connection is not a reliable conversation boundary: hosts may reuse it for subagents or keep it alive across context compaction. Suppressing source by default can therefore point an agent at text that its current context never received.

• default cross-call source deduplication to off
• enable it only for explicit truthy CODEGRAPH_EXPLORE_DEDUP=1 style values
• preserve the existing optimization for hosts that guarantee one durable agent context per connection
• test both the safe default and explicit opt-in behavior

This is deliberately limited to the correctness fix and does not add installer hooks or host trust state.

Verification

• npm run build:kernel
• npm run build
• focused dedup suite — 26 passed
• npm test -- --reporter=dot — 194 files, 3231 passed, 10 skipped