refactor(mcp-server,daemon): migrate worker-URL env to canonical AGENTKEYS_WORKER_{MEMORY,AUDIT}_URL

[hanwencheng]

What & why

Canonical-names cleanup (arch.md §5 / terminology-source-of-truth). The MCP server and daemon read their worker base-URLs from the bare AGENTKEYS_MEMORY_URL / AGENTKEYS_AUDIT_URL, diverging from the canonical AGENTKEYS_WORKER_<svc>_URL family that scripts/operator-workstation.env, the CLI, the fleet tooling, and the daemon's own --config-url (AGENTKEYS_WORKER_CONFIG_URL) already use. This renames the MCP server + daemon to the canonical spelling.

AGENTKEYS_BROKER_URL is intentionally untouched — the broker is not a worker, so the bare name is already canonical.

Clean re-land of #202 (do not merge that branch)

This supersedes #202. While triaging #202 I found its branch lineage carries the malicious secret-exfiltration GitHub workflows removed from main in the June incident (PR #235) — its commit 2 is "security: remove malicious exfil workflows from branch." Rather than merge a branch with that history, this redoes the identical refactor fresh off current main (cdea265) with none of the contaminated lineage. main is already clean; this PR touches only the 5 intended files.

Zero-downtime (accept-both fallback)

A deployed remote MCP host still carries the old bare names in /etc/agentkeys/mcp.env until its next setup-mcp-host.sh run. To avoid a window between the binary upgrade and that rewrite, config.rs::from_cli reads the canonical AGENTKEYS_WORKER_* var first (clap env, or --memory-url/--audit-url), then falls back to the legacy bare name via std::env::var(...) only when unset. The fallback drops out naturally once the next deploy rewrites mcp.env.

The daemon hard-renames (no fallback): dev.sh passes --memory-url explicitly and operator-workstation.env only defines the canonical name, so the bare env= fallback was already dead code — the rename also fixes that latent inconsistency.

Files

• crates/agentkeys-mcp-server/src/config.rs — clap env (memory/audit) → canonical + the from_cli accept-both fallback.
• crates/agentkeys-daemon/src/main.rs — memory_url env → canonical (matches the adjacent config_url).
• crates/agentkeys-mcp-server/README.md — Docker -e flags.
• scripts/setup-mcp-host.sh — both mcp.env heredocs (xiaozhi + self-hosted).
• docs/arch.md — §5 canonical-names row for the AGENTKEYS_WORKER_<svc>_URL family (records the legacy aliases + the fallback).

Verification

• cargo check -p agentkeys-mcp-server -p agentkeys-daemon → exit 0, 0 warnings.
• bash -n scripts/setup-mcp-host.sh → OK.
• grep confirms the only residual bare-name references are the deliberate fallback in config.rs.

To test this — deploy surfaces

• Remote broker host (touches agentkeys-mcp-server + agentkeys-daemon + setup-mcp-host.sh): bash scripts/setup-broker-host.sh --ref claude/mcp-worker-url-env — rebuilds the binaries and rewrites mcp.env with the canonical names in the same idempotent run.
• Local daemon + web: picked up on the next dev.sh rebuild (already canonical via operator-workstation.env).
• No chain redeploy, no cloud (setup-cloud.sh) run needed.

🤖 Generated with Claude Code