fix: handle blank tool descriptions during discovery

[rudycelekli]

Problem and change

A valid discovered tool with a whitespace-only description and no explicit risk value raises IndexError while reading its first description word. That aborts both public discover_system and discover_fixture, although an empty description already uses the existing default.

Check whether description tokens exist before indexing. Preserve the existing first-word risk heuristic, medium fallback and explicit risk values. No scoring, population, provider, schema or risk policy changes.

Native proof and required checks

• Actual owned YAML → GovernanceFixture.load/Pydantic → shipped mock provider/governance wrapper → both public discovery functions: 4 failures / 6 controls before.
• After: 14 focused tests pass, including ten native blank/empty/ordinary/explicit-risk cases and four existing role/case-order controls.
• Exact signed+DCO head 29440eaea47c1ddebc628fbe4d9ddf48ee81e42a: whole-package Ruff 0.16.9, Bandit medium/high, layout validation, all eleven shipped example fixture validations and diff checks pass. Advisory provider Mypy retains one unrelated baseline error; no blanket type-check pass claimed.

The shipped mock and structural governance path are real; no paid model, service inference or discovery accuracy assessment is claimed. An initial harness called an incorrect loader method and was corrected before the matched regression run; those setup failures are excluded from the counts.

Related earlier discovery work (#127 case ordering, #129 role IDs, #131 admin role handling, #128 generated-fixture persistence and #153 probe lifetime) addresses different causes. This patch changes only blank-description token access.

AI assisted implementation and tests; source reviewed and native checks executed before publication. Exact-head fork Python 3.10/3.11/3.12 CI is recorded separately from upstream PR checks.

Exact-head fork CI Python 3.10, 3.11 and 3.12: all three jobs passed (workflow receipt). These are the unchanged install, lint, Bandit, layout and fixture gates; native pytest evidence above was run locally. Upstream PR CI is recorded separately.