feat: add deterministic preview rendering

docs/MCP_CONTRACT.md

@@ -32,16 +32,25 @@ response includes project identity, revision, source hash, adapter version, and
 - `docforge_propose_node_delete`
 - `docforge_validate_changeset`
 - `docforge_get_changeset_diff`
+- `docforge_preview_changeset`
 
-Proposal tools may write only below the configured changeset root. They never change canonical
-files. Without `--proposal-writer`, mutation tools return `proposal_access_disabled`. Validation and
-diff retrieval remain available for existing changesets.
+Proposal tools may write only below the configured changeset or isolated preview roots. They never
+change canonical files or declared project output. Without `--proposal-writer`, changeset mutation
+tools return `proposal_access_disabled`. Validation, diff retrieval, and preview remain available
+for existing changesets. A preview accepts a declared view ID, not a renderer name or command.
+
+## Render boundary
+
+`docforge_render_status` recomputes expected hashes without writing. `docforge_preview_changeset`
+runs only a project-declared view through DocForge's fixed built-in renderer registry and writes one
+atomic HTML file below the configured preview root. Rendering declared project output is available
+only through the explicit local CLI integration command.
 
 ## Excluded tools
 
 The normal server never exposes shell execution, arbitrary reads or writes, canonical changeset
-application, preview generation, renderer execution, Git mutation, project builds, deployment,
-publication, global project selection, or cross-project retrieval.
+application, declared project-output rendering, arbitrary renderer execution, Git mutation, project
+builds, deployment, publication, global project selection, or cross-project retrieval.
 
 DocForge pins the official stable Python MCP SDK to the compatible `mcp>=1.28,<2` release line.
 Migration to a later major release requires a separate contract and protocol compatibility review.