feat(agent): add external MCP client support

Reuse OpenCode 2 HTTP/stdio clients with per-session read-only grants,
native approval and sanitized owner-scoped MCP status. Narrow the
environment inherited by trusted local MCP processes.

Validated in an isolated checkout with bun run check and 20 focused tests.

src/routes/chat.ts

@@ -23,6 +23,7 @@ import { registerChatInteractionRoutes } from "./chatInteractionRoutes.js";
 import { createChatRunState } from "./chatRunState.js";
 import { registerChatSessionRoutes } from "./chatSessionRoutes.js";
 import { registerChatStreamRoute } from "./chatStreamRoute.js";
+import { registerMcpStatusRoutes } from "./mcpRoutes.js";
 
 export type BuildChatRouterOptions = {
   frontendActionCoordinator: FrontendActionCoordinator;
@@ -132,6 +133,7 @@ export const buildChatRouter = (options: BuildChatRouterOptions) => {
     sessionTranscriptStore,
     sessionUiStateStore,
   });
+  registerMcpStatusRoutes(chatRouter, { sessionMetadataStore, runtime });
 
   registerChatAuxiliaryRoutes(chatRouter, {
     activeRuns,