buzz-acp: add structured MCP server configuration

[wolfyy970]

Summary

Adds a versioned JSON config for defining multiple named MCP servers in buzz-acp.

The new --mcp-config and BUZZ_ACP_MCP_CONFIG inputs preserve each server's name, command, arguments, order, and environment without shell parsing. Invalid configuration fails before startup. The existing BUZZ_ACP_MCP_COMMAND path is unchanged and remains first when both inputs are present.

MCP environment values are redacted from Buzz wire logs and observer events. Serialized request payloads echoed by an adapter in errors or diagnostics are suppressed without changing the protocol value.

Desktop also reserves BUZZ_ACP_MCP_CONFIG because it points to a code-execution surface.

Fixes #4154.

Notes

Structured MCP servers receive only their declared environment in the ACP request. This is not process isolation: the adapter still inherits the harness environment and controls its MCP child processes.

The diagnostic redaction overlaps #3417.

Validation

• cargo test -p buzz-acp --no-fail-fast (686 unit tests, 10 integration tests)
• cargo clippy -p buzz-acp --all-targets -- -D warnings
• cargo fmt --all -- --check
• ./bin/just ci

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f9e32d5848

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[wolfyy970]

I opened #4301 to capture the broader Agent Capsule product shape and the proposed PR sequence. This PR remains the first narrow slice: structured, named MCP configuration in buzz-acp. I am keeping Project connections, portable skills, immutable template versions and live agent updates in separate follow-up PRs so each boundary can be reviewed independently.