fix(mcp): keep save and upload targets writable

[abhinav7x94]

Summary

• prefer the active space only when it is writable
• clear stale selections when permissions change instead of silently retargeting
• prevent Save and Upload from enabling or submitting with non-writable targets
• add shared selection helpers and regression coverage for read-only and empty-space states

Problem

A visible but read-only active space could be initialized as the target even though the selector only listed writable spaces. The form then showed a placeholder while still submitting the hidden read-only tag, leading to a downstream 403.

Test plan

• cd apps/mcp && bun run test:unit (28 tests)
• cd apps/mcp && bun run check-types
• Biome check on all changed files
• git diff --check

[MaheshtheDev]

🤖 AI-assisted triage, reviewed by @MaheshtheDev.

Thanks! Replaced by the v5 migration (#1783): MCP now uses namespace instead of containerTag scoping. Closing.