FN-7023: forward MCP runtime config to AI lanes

Forward enabled MCP server configuration through AI session creation and validation paths.

- Resolve and materialize effective MCP servers with secret values at runtime for triage, execution, review, merge, evaluation, reflection, mission validation, and dashboard chat/planning lanes.
- Add runtime support guards, Claude CLI MCP config generation, and a dashboard validation route for MCP server reachability probes.
- Cover MCP forwarding, provider support behavior, settings resolution, validation, and pi extension config generation with targeted tests and docs.

Files changed:
 .changeset/fn-7023-mcp-runtime-forwarding.md       |   7 +
 docs/agents.md                                     |   2 +
 docs/secrets.md                                    |   1 +
 docs/settings-reference.md                         |   6 +-
 .../src/__tests__/mcp-lane-forwarding.test.ts      |  79 +++++++++++
 .../src/__tests__/mcp-validate-route.test.ts       | 111 ++++++++++++++++
 packages/dashboard/src/chat.ts                     |   3 +
 packages/dashboard/src/planning.ts                 |   5 +
 packages/dashboard/src/routes.ts                   |  90 ++++++++++++-
 .../src/__tests__/mcp-lane-forwarding.test.ts      |  95 ++++++++++++++
 .../engine/src/__tests__/mcp-resolution.test.ts    | 104 +++++++++++++++
 .../src/__tests__/mcp-runtime-support.test.ts      |  44 +++++++
 .../src/__tests__/mcp-validation-service.test.ts   |  69 ++++++++++
 packages/engine/src/__tests__/pi.test.ts           |  65 +++++++++
 packages/engine/src/agent-reflection.ts            |   3 +
 packages/engine/src/agent-runtime.ts               |  36 ++++-
 packages/engine/src/agent-session-helpers.ts       |   2 +
 packages/engine/src/evaluator.ts                   |   3 +
 packages/engine/src/executor.ts                    |  14 ++
 packages/engine/src/index.ts                       |   3 +
 packages/engine/src/mcp-resolution.ts              |  81 ++++++++++++
 packages/engine/src/mcp-runtime-support.ts         |  41 ++++++
 packages/engine/src/mcp-validation-service.ts      | 146 +++++++++++++++++++++
 packages/engine/src/merger-ai.ts                   |   5 +
 packages/engine/src/merger.ts                      |  14 ++
 packages/engine/src/mission-execution-loop.ts      |   3 +
 packages/engine/src/pi.ts                          |  44 +++++--
 packages/engine/src/reviewer.ts                    |   3 +
 packages/engine/src/runtime-resolution.ts          |   8 +-
 packages/engine/src/step-session-executor.ts       |   6 +-
 packages/engine/src/triage.ts                      |   5 +
 packages/pi-claude-cli/index.ts                    |  20 ++-
 packages/pi-claude-cli/src/mcp-config.ts           |  65 ++++++++-
 33 files changed, 1150 insertions(+), 33 deletions(-)

Fusion-Task-Id: FN-7023
Fusion-Task-Lineage: ea09c6c7-b3c3-4af6-9ca6-0ebbfec17139

docs/settings-reference.md

@@ -160,7 +160,11 @@ Each server is named and uses one transport:
 
 Resolution uses project-over-global precedence by server name. The project-level `enabled` flag overrides the global flag when set; if the effective flag is false, no MCP servers are active. When enabled, global servers are loaded first, project servers with the same `name` replace them, and a project server with `enabled:false` removes the inherited server.
 
-Secret rule: `env` and `headers` maps are sensitive. Values must be Fusion secret references such as `{ "secretRef": "sec_...", "scope": "project" }` or `{ "secretRef": "sec_...", "scope": "global" }`. Write-boundary sanitizers and validators reject plaintext strings in these fields. Claude Desktop-style imports return `secretsToCreate` descriptors for plaintext env/header values and replace those values with secret refs in the imported definitions.
+Enabled MCP servers are trusted once configured. Fusion materializes the effective server set at AI session creation and forwards it to every MCP-capable AI lane, including chat/planning, executor, reviewer, validator, merger, workflow model nodes, summarization, evaluator, research, cron/automation, mission, and reflection paths. Runtime support is guarded: Claude/pi/ACP-compatible runtimes receive MCP servers, while mock or unsupported runtimes skip forwarding and emit only a structured count/provider/runtime log entry, never server definitions or secret values.
+
+Secret rule: `env` and `headers` maps are sensitive. Values must be Fusion secret references such as `{ "secretRef": "sec_...", "scope": "project" }` or `{ "secretRef": "sec_...", "scope": "global" }`. Write-boundary sanitizers and validators reject plaintext strings in these fields. Claude Desktop-style imports return `secretsToCreate` descriptors for plaintext env/header values and replace those values with secret refs in the imported definitions. At runtime, secret references are revealed through the scoped secrets store immediately before forwarding or validation, kept only in memory, and never echoed in API responses.
+
+`POST /api/mcp/validate` validates an MCP server definition or configured server name against the current project context. The route resolves and materializes the target server with the same secret rules, then performs a bounded reachability probe (`stdio` supervised spawn, `sse`/`streamable-http` bounded fetch) and returns only `{ status, message? }` without resolved env/header contents.
 
 ### Notification providers (pluggable)