[codex] isolate worker MCP config

[cneuralnetwork]

Summary

Adds role-scoped MCP configuration for agent sessions so Claude Code workers no longer inherit the orchestrator/user MCP server set by default.

What changed

• Added typed agentConfig.mcp support with inherit, none, and custom modes.
• Threaded resolved role config through spawn, restore, hooks, and pre-launch.
• Made Claude Code workers default to a strict empty MCP config while orchestrators continue to inherit normal Claude config.
• Added support for inline custom MCP servers or repo-relative custom config files.
• Regenerated OpenAPI and frontend TypeScript schema, and documented the worker MCP config shape.

Root cause

AO already merged per-role agent/model/permission overrides, but MCP server selection was not represented in AgentConfig, so Claude Code worker sessions fell back to the global Claude MCP configuration.

Validation

• SHELL=/bin/bash GOTOOLCHAIN=auto GOSUMDB=sum.golang.org go test ./...
• GOTOOLCHAIN=auto GOSUMDB=sum.golang.org go test -race ./internal/domain ./internal/session_manager ./internal/adapters/agent/claudecode ./internal/storage/sqlite/store ./internal/httpd/...
• GOTOOLCHAIN=auto GOSUMDB=sum.golang.org SHELL=/bin/bash go vet ./...
• npm run api
• npm run frontend:typecheck
• npm --prefix frontend test
• golangci-lint on changed backend packages: 0 issues
• git diff --check

Full npm run lint still reports unrelated pre-existing goimports findings in backend/internal/legacyimport/config.go, backend/internal/legacyimport/project_test.go, and backend/internal/service/importer/importer_test.go after its go test ./... step passes.

Fixes #2195