revert(mcp): entitle the admin catalog by webchat, not by attachment

[spacedragon]

Reverts #2122 and widens the gate that PR replaced.

agentconnect-admin is not an enable-list name again — nothing to install, no
console Add-menu entry, no per-agent setting. The entitlement is the launch
surface: every agent receives the CP-delegated admin catalog in its owner's
private webchat, and no agent receives it anywhere else. Before #2122 only the
built-in preset did; this extends that same shape to all agents.

What changed

• control plane — the live authority predicate drops the preset assertion
  (and its preset_mismatch reason, plus the presets dependency), and both
  serializable operation fences drop the preset_agent join. The preset is
  provisioned without mcpServers again, and move admission no longer special-cases
  the name.
• daemon — descriptor provisioning gates on the webchat entitlement alone
  (webchat?.remoteMcp), the preset marker is not read, and activation admits no
  such enable-list name again. The Apps host still filters the name defensively.
• console — the "AgentConnect Admin MCP — Builtin" Add-menu offer and its
  attached row are gone.
• migration 20261007000000_drop_admin_mcp_attachment strips the entry
  20261006000000 attached (and any the console attached meanwhile), so no daemon
  sees an enable-list name it cannot configure. The earlier migration file stays in
  place for installs that already applied it.
• protocol — restores the ./mcp-app subpath export that feat(mcp): make the admin catalog an attachable Builtin MCP server #2122 dropped while
  its importers kept importing it.
• docs — webchat-preset-agentconnect-mcp.md (§1, §2.1, §4, §5.2, §8, §11,
  §13), daemon-detailed-design.md §7.1/§7.6, system-detailed-design.md D8,
  webchat-multi-agents.md, and the docs index now state the webchat-surface rule.

Verification

• pnpm typecheck (all packages) and pnpm lint clean.
• control-plane test:unit — 2531 passed; full test:int — 135 files / 2102
  passed, which includes migrate deploy of the new migration.
• web test green; daemon suites covering this path green
  (daemon-remote-mcp-admission, cp-agent-reconcile, session-manager,
  remote-webchat-grant, mcp-native-ui, …).
• The daemon full run's remaining failures are this host's known live-runtime /
  load-sensitive ones (acp-matrix, daemon-smoke, evaluation-runner,
  skill-install-*), all of which pass or are pre-existing off the parallel run.

🤖 Generated with Claude Code

[agentconnect-md-test]

Reviewed c553f487 → 691afa9d. No blocking regressions found.

The webchat entitlement is consistent across daemon provisioning and control-plane authorization. Conversation ownership, private-session checks, single-participant restrictions, and browser approval for writes remain enforced.

Reviewed the exact revisions through GitHub; local tests were not run.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}