feat: unify MCP and secret management

[JNHFlow21]

Summary

• add a neutral unified MCP registry with CRUD, import, adoption, targeting, and detected-agent-only reconciliation
• centralize static credential values and grant each MCP only its declared secrets
• add safe macOS MCP management, import preview, CI, privacy scanning, release docs, and the 0.2.0 version baseline
• report and preserve unsupported remote HTTP/SSE/OAuth MCPs instead of rewriting them unsafely

Validation

• 72 Python unit tests
• 1 Python integration test
• clean-home and adoption end-to-end checks
• Swift Package build
• Xcode Release build with signing disabled
• Python wheel build
• repository privacy scan

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 185b800fc5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Write imports to the configured secret file

When a configuration sets secretFile to a non-default path, this import writes migrated values to paths.secrets_file instead of config.secret_file. The generated wrappers use config.secret_file, so mcp import --adopt removes the working native entry and replaces it with a wrapper that cannot find its migrated credentials; conflict detection also consults the wrong store. Use the loaded configuration's secret path for both reads and writes here.

Useful? React with 👍 / 👎.