Add project router controls to MCP setup

[hmishra2250]

Why

The G004 experiment (416 traces, fresh banks) validated the project-local router card in the post-approval setup mcp state: +100pp routing lift on Claude and +93.75pp on Codex, safety 0/104 treatment-only regressions per harness (simultaneous upper bound 3.48%, passing the 5% gate with margin), task-success non-inferiority passed. This was the strongest SHIP verdict in the router-card program and the only one without a delivery PR.

Summary

• firecrawl setup mcp --agent <claude-code|codex> --project <path> --router-card writes the managed project router card after MCP setup succeeds.
• Gated: requires --agent (claude-code/codex only), an explicit --project (safe-path resolved), and authentication; --no-router-card leaves guidance unchanged; --remove-router-card removes only the managed block and conflicts with --router-card.
• add-mcp now runs with cwd resolved to --project, so the default (no --global) registration is project-scoped — matching the certified G004 state (project MCP + project card). --global remains available but is not combined with the card by default.
• Stacks on the shared router-state service (Add managed project router state #158), which stacks on secure hosted MCP setup (Secure hosted MCP credential setup #155).

Review question: should --router-card --global together be rejected? That combination (global registration + project card) is a state G004 did not test; the default path avoids it.

Test Plan

• src/__tests__/commands/setup-router-options.test.ts — option registration/conflict contracts (48 lines).
• src/__tests__/commands/setup.test.ts — +170 lines: card written only with auth+agent+project; unsupported agents rejected; remove path bounded; no writes on skills/defaults subcommands.
• Experiment evidence: G004/G006/G008 sessions in Convex; closure report router-card-confidence-closure-20260720.md (sha256 6629e0d1…). Raw results remain in Convex.

🤖 Generated with Claude Code

[hmishra2250]

Opened prematurely before local test verification and author review; will be re-proposed after both.