docs(cloud-security): IDE & MCP page (P3.3) — HOLD OPEN

[maximelb]

HOLD OPEN — do not merge. Docs for roadmap 15 P3.3, held for the docs round alongside #355 and #360.

Adds docs/cloud-security/mcp.md and a nav entry after Command Line Interface: setup for Claude Code and Cursor, the profiles, the permissions, and the four AppSec code-lane tools.

Depends on lc-mcp-server#58, which is ready for review and not yet merged. Nothing on this page is true until that ships — merge order is lc-mcp-server#58, then this.

The page leads with the two things that surprise people rather than burying them:

• cloudsec_code_findings will not list without a repository. The findings backend has no "any repository" selector, so an unscoped call would quietly return the reader's whole worklist, cloud findings included, under a tool named for the code lane. facets: true is the unscoped mode.
• cloudsec_code_scan_local runs on the reader's own machine, needs Docker, takes minutes, and cannot scan for secrets — a credential's identity is a digest keyed by a value only the hosted lane holds.

It also documents the repo key trap found while testing: the filter is matched exactly against a key whose owner segment carries the connection's configured casing, while a finding's code.repo_name is the platform's display casing.

Deliberately not linked to code-scanning.md: that page is itself unmerged (#355), so this page links only to files already on master.

🤖 Generated with Claude Code

[maximelb]

Superseded by #362, which consolidates this branch with the other code-lane docs branches into one page set off master and reconciles every claim against the shipped code (nine differences are listed in that PR's body). Leaving this open rather than closing it — Maxime closes.