[orwellsanimal]: Sequencing, per the review on now-mcp#6: real counts (now-mcp#6 + #7) **without** #4's query checks would move rio from "can't count" to "counts, sometimes confidently wrong" (`state=new` → 0, an unknown field → the whole table). This issue therefore adopts now-mcp#4 **and** #6/#7 in one re-pin, not the counts first.

Context: GitHub issue orwellsanimal/servicenow-rio#10 (closed, 1 comments, reported 2026-10-14): ## Why rio is going to the corporate laptop (#3, #4), and right now it can state a confident wrong number: - **Silently dropped filters.** `now_query` passes the model's encoded query straight through. ServiceNow drops what it can't apply: `state=new` matches nothing, and `nonsense_field=xyz` returns the whole table. Measured on dev442835; see now-mcp#4 and whitcortex#2626. - **No real count.** `now_aggregate` is gated off with released PySNC (#9), so "how many…?" falls back to `now_query`'s capped row count (`count: 10, truncated: true`). Both are fixed upstream, in now-data, not in rio: - n