Hosted-MCP: discovered tool catalogs are published per extension id, not per installation — cross-user metadata exposure on multi-principal servers

Hosted-MCP activation runs tools/list discovery under the ACTIVATING user's credential and publishes the discovered package into the active-extensions registry keyed by extension id alone (product_lifecycle::commit_activation → active_extensions / publish). Installations are per-user, but the published catalog is shared: the last activation wins for every user of that extension.

For an MCP server that serves per-principal catalogs (e.g. a marketplace serving one tool set to concierge bearers and another — including per-customer connector tools — to worker bearers), this means:

1. Metadata exposure: user A's discovered tool names/descriptions (potentially naming A's connected third-party services) become model-visible to user B. Calls still fail server-side (B's bearer doesn't authorize them), but the disclosure has already happened in B's tool surface.
2. Surface instability: each activation replaces the catalog for everyone; a user's visible tools flap depending on who activated last.

Suggested direction: key published hosted-MCP packages by installation (or overlay per-user discovered catalogs over the bundled base), so a user's surface reflects the catalog their credential discovered.

Observed while integrating a multi-principal marketplace MCP server (#6760); flagged in review there by @serrrfirat.