buzz-acp: add structured MCP server configuration

[wolfyy970]

Summary

This moves an agent's MCP tool set out of one opaque command and into a versioned, reviewable config. The same setup can be reproduced across agents and machines, and operators can see what will run before giving it credentials.

buzz-acp now accepts multiple named MCP servers through --mcp-config or BUZZ_ACP_MCP_CONFIG. Version 1 supports stdio and preserves each server's name, command, arguments, order and environment without shell parsing. Invalid config stops startup.

The existing BUZZ_ACP_MCP_COMMAND path is unchanged and remains first when both inputs are present. The transport tag lets #4271 add HTTP without introducing another config format.

MCP environment values are redacted from wire logs, observer events, diagnostics and returned adapter errors.

Fixes #4154.

Boundary

Structured servers receive only their declared environment in the ACP request. The adapter still inherits the harness environment and launches the MCP processes, so this is explicit configuration, not process isolation.

Validation

• cargo test -p buzz-acp --no-fail-fast (697 unit tests, 10 integration tests)
• cargo clippy -p buzz-acp --all-targets -- -D warnings
• cargo fmt -p buzz-acp -- --check
• Desktop reserved-environment tests (42 passed)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f9e32d5848

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[wolfyy970]

#4301 now describes the broader portable-agent lifecycle using Buzz's existing agent, template, connection, version and snapshot concepts. This PR remains the first narrow slice: structured, named MCP configuration in buzz-acp.

[wolfyy970]

@tlongwell-block @wpfleger96, @custard-pirate and I agree on the MCP split: #4164 owns the versioned document and stdio transport; #4271 adds HTTP to that schema. #4480 can then use the same document for live changes instead of adding a third config format.

That leaves Buzz with one MCP configuration surface and one compatibility input. Could one of you confirm this ownership split? If so, I will keep #4164 at that boundary and help adapt #4271 to it.