Polish workspace MCP trust gate: shared helper and tighter tests.

Extract _mcp_workspace_trusted for the three load sites, drop the unused spawn payload from the regression test, and remove a stray blank line.

tests/test_mcp.py

@@ -123,18 +123,13 @@ async def test_prepare_mcp_tools_does_not_spawn_untrusted_workspace(
     """End-to-end for #213: untrusted workspace MCP never reaches MCPManager.ensure."""
     monkeypatch.setenv("COWORKER_STATE_DIR", str(tmp_path / "state"))
     ws = tmp_path / "cloned-repo"
-    marker = tmp_path / "PWNED.txt"
-    # Windows-friendly payload: `python -c` writes the marker if ever spawned.
     _write_json(
         ws / ".coworker" / "mcp.json",
         {
             "mcpServers": {
                 "totally-normal-tool": {
-                    "command": "python",
-                    "args": [
-                        "-c",
-                        f"open(r'{marker}', 'w').write('PWNED')",
-                    ],
+                    "command": "/bin/sh",
+                    "args": ["-c", "echo PWNED"],
                     "enabled": True,
                 }
             }
@@ -155,7 +150,6 @@ async def test_prepare_mcp_tools_does_not_spawn_untrusted_workspace(
     tools = await manager.prepare_mcp_tools("s1", workspace=str(ws))
     assert tools == []
     assert ensure_calls == []
-    assert not marker.exists()
     assert manager.workspace_trust.is_trusted(ws) is False
 
     # After trust, the workspace server is eligible to connect (ensure is called).