feat(mcp): OAB MCP Facade MVP — shared openab-mcp crate + broker loopback HTTP server (#1448)

* feat(agent): OAB MCP Facade MVP — mcp-facade stdio server + tool_filter enforcement

Implements the OAB MCP Adapter ADR (#1446) MVP slice in openab-agent:

- New 'openab-agent mcp-facade' subcommand: inbound stdio MCP server
  exposing exactly search_capabilities / execute_capability (ADR §6.1,
  §6.4), backed by the existing McpRuntimeManager + meta_tool dispatcher
  (one capability dispatcher, two frontends).
- search_capabilities: lazy discovery across all configured servers with
  per-provider failure isolation, name-collision qualification
  (server:tool), risk labels from MCP tool annotations, and redacted
  provider errors in an 'unavailable' list.
- execute_capability: exact-name resolution against current discovery,
  then delegation to the shared call path (jsonschema argument
  validation, timeouts, circuit breaker, redaction).
- tool_filter enforcement (accepted MCP ADR §5.6 contract, previously
  parsed but unenforced): glob include/exclude applied at discovery
  (fetch_tools, pre-cache) and execution (call_tool, pre-connect) for
  both the meta-tool and the facade.
- rmcp features: + server, transport-io.

Broker-side ACP session/new mcpServers advertisement is PR-2.

* feat(mcp): OAB MCP Facade MVP — shared openab-mcp crate + broker loopback HTTP server

Implements the OAB MCP Adapter ADR (#1446) MVP:

- New workspace crate crates/openab-mcp: the MCP runtime extracted from
  openab-agent (client runtime, OAuth/PKCE + auth.json store, layered
  mcp.json config, tool cache, circuit breaker, jsonschema validation,
  redaction) plus the new OAB MCP Facade — an inbound MCP server
  exposing exactly search_capabilities / execute_capability.
- Facade transport: loopback-only Streamable HTTP (http://127.0.0.1:
  <port>/mcp). Non-loopback binds are refused. Any MCP-capable coding
  CLI on the host can connect.
- Broker activation: presence of [mcp] in config.toml starts the
  listener in-process (absent = no listener, backward compatible).
  openab-agent re-exports the crate (crate::{mcp,auth} shims + llm type
  layer + HostBridge) — one runtime, two hosts, zero duplication.
- tool_filter enforcement (accepted MCP ADR §5.6, previously parsed but
  unenforced): glob include/exclude applied at discovery (pre-cache)
  and execution (pre-connect), for the meta-tool and facade alike.
- openab-agent mcp-facade --listen: standalone facade server.
- acp.rs env-mutating tests moved to temp_env (single global lock
  domain; a private ENV_LOCK raced with temp_env-based tests once the
  moved tests changed binary scheduling); session_new_missing_key now
  sandboxes HOME instead of deleting the developer's real auth.json.
- Dockerfile.unified + ci-openab-agent.yml updated for the new member.

* fix(docker): stub crates/openab-mcp in dependency-cache stages

The workspace gained crates/openab-mcp but only Dockerfile.unified's
dummy stage was updated; the base and per-CLI Dockerfiles failed at
'cargo build' with 'failed to load manifest for workspace member'.
Apply the same COPY/mkdir/stub/rm/touch pattern everywhere (incl.
Dockerfile.gateway/builder/native/agentcore, which share the pattern
but are outside this PR's smoke matrix).

---------

Co-authored-by: chaodu-agent <chaodu-agent@users.noreply.github.com>

Author: chaodu-agent

.github/workflows/ci-openab-agent.yml

@@ -4,10 +4,13 @@ on:
   push:
     paths:
       - 'openab-agent/**'
+      # openab-agent path-depends on the shared MCP runtime crate
+      - 'crates/openab-mcp/**'
       - '.github/workflows/ci-openab-agent.yml'
   pull_request:
     paths:
       - 'openab-agent/**'
+      - 'crates/openab-mcp/**'
       - '.github/workflows/ci-openab-agent.yml'
 
 jobs: