feat(opencode): add env variable format translation for MCP config

[zdrapela]

Summary

OpenCode uses {env:VAR} format for environment variable references in its MCP config (docs, while rulesync's canonical format uses ${VAR}. This PR adds bidirectional translation and extracts a shared env var conversion utility used by both OpenCode and Cursor.

I ran into an issue while configuring SourceBot with API key, where this config didn't get translated into working MCP config for OpenCode.

    "sourcebot": {
      "description": "Internal Red Hat code search via Sourcebot (requires VPN)",
      "type": "http",
      "url": "https://sourcebot.XXX.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${SOURCEBOT_API_KEY}"
      }

Changes

src/features/mcp/mcp-env-var-format.ts (new)

• Shared utility with convertEnvVarRefsFromToolFormat() and convertEnvVarRefsToToolFormat()
• Translates env var references in both env and headers fields across all MCP servers
• CANONICAL_ENV_VAR_PATTERN regex avoids double-converting values already in ${env:} form

src/features/mcp/mcp-env-var-format.test.ts (new)

• 10 dedicated tests using a generic {tool:VAR} pattern, independent of any specific tool
• Covers: env values, headers values, multiple refs, no-env servers, multiple servers, double-convert avoidance, round-trip

src/features/mcp/opencode-mcp.ts

• Add OPENCODE_ENV_VAR_PATTERN regex for matching {env:VAR} (with negative lookbehind to avoid matching Cursor's ${env:VAR})
• Wire up shared utility in fromRulesyncMcp() (export: ${VAR} -> {env:VAR}) and toRulesyncMcp() (import: {env:VAR} -> ${VAR})

src/features/mcp/cursor-mcp.ts

• Replace inline env var conversion functions with shared utility calls
• Cursor now also translates env var refs in headers (was env-only before)

Design Decisions

• Shared utility: Extracted common env var conversion logic into mcp-env-var-format.ts to eliminate duplication between OpenCode and Cursor. Each tool only provides its tool-specific regex pattern and replacement string.
• Headers translation for both tools: Both OpenCode and Cursor now translate env var refs in headers, since remote MCP servers use env var references in headers (e.g., Authorization: Bearer {env:API_KEY}).
• Negative lookbehind: The OpenCode import regex (?<!\$)\{env:...} avoids matching Cursor's ${env:VAR} format, preventing cross-tool interference.
• Consistent capture groups: Both import and export regexes use [^}:]+ to exclude colons, ensuring round-trip consistency.
• Test layering: Shared utility has dedicated tool-agnostic tests; tool-specific files keep only integration tests that verify wiring and full-pipeline behavior.

How it was tested

• 21 new tests across 3 files (10 unit + 11 integration) — all pass
• pnpm cicheck passes locally (format, lint, typecheck)
• CI passes (Code Quality, Build, E2E on ubuntu/macOS/macOS-intel/Windows)
• 3 rounds of /review-pr with parallel code-review and security-review agents — all mid/high findings fixed, final iteration has only low-severity findings remaining

[dyoshikawa-claw]

LGTM. All CI checks pass and all findings from code/security review are low severity. Well-designed shared utility extraction.