Add native MCP config format, replace vmcp YAML

[JAORMX]

Summary

• Replace the vmcp config pass-through (--mcp-config accepting raw vmcp YAML with groupRef, incomingAuth.type, etc.) with a simpler brood-box-native format that exposes only the two sections we use: authz.policies (Cedar policies) and aggregation (tool conflict resolution)
• Infer the custom authz profile automatically when the MCP config contains Cedar policies — no need to pass --mcp-authz-profile custom separately
• Support inline mcp.config in the global config YAML as an alternative to --mcp-config file path

Before:

groupRef: default
incomingAuth:
  type: anonymous
  authz:
    type: cedar
    policies:
      - 'permit(principal, action == Action::"list_tools", resource);'

After:

authz:
  policies:
    - 'permit(principal, action == Action::"list_tools", resource);'

Changes by layer

Layer	Files	What changed
Domain	pkg/domain/config/config.go	New MCPFileConfig, MCPFileAuthzConfig, MCPAggregationConfig, MCPWorkloadToolConfig, MCPToolOverride types with Validate(); MCPConfig.ConfigPath → MCPConfig.Config *MCPFileConfig
Infra	internal/infra/mcp/configloader.go	New LoadMCPFileConfig(path) — reads YAML, validates, returns (nil, nil) for missing files
Infra	internal/infra/mcp/translate.go	New translateAggregation() and translateAuthz() — converts brood-box snake_case to vmcp camelCase types
Infra	internal/infra/mcp/provider.go	Replace configPath string with mcpConfig *MCPFileConfig; use translation instead of vmcp YAML loader
Infra	internal/infra/mcp/profiles.go	Error message: "vmcp config" → "MCP config"
App	pkg/sandbox/sandbox.go	resolveMCPConfig uses Config instead of ConfigPath
CLI	cmd/bbox/main.go	Load via LoadMCPFileConfig, implicit custom profile inference, updated flag help text
Docs	USER_GUIDE.md, CLAUDE.md	All vmcp YAML examples → native format

Test plan

• task verify passes (fmt + lint + test, 0 issues, 0 failures)
• New tests: TestMCPFileConfig_Validate (14 cases), configloader_test.go (7 cases), translate_test.go (7 cases)
• Updated tests: main_test.go MCP override test, profiles_test.go error message
• Manual: create bbox-mcp.yaml with Cedar policies, verify bbox claude-code --mcp-config ./bbox-mcp.yaml works
• Manual: verify implicit custom profile inference (no --mcp-authz-profile needed)
• Manual: verify inline mcp.config: struct in global config parses correctly

🤖 Generated with Claude Code

[jhrozek]

Review finding: security consideration around workspace-local agent overrides and MCP.Config propagation.