Make MCP servers and skills personal, not managed

[david-siqi-liu]

🥞 Stack (AIGTWY-4342 ucode configure)

• Make MCP servers and skills personal, not managed #438 ⬅ this PR
  • Replace ucode setup with a ucode configure-centered workflow #433
    • Add a sandbox that exercises every ucode configure path end to end #440

Superseded: #437 (folded into #433, so the draft slot arrives together with its first writer).

---

What did you change, and why?

MCP servers and UC Skills were carried inside the managed config, which meant an admin publishing a
config could silently rewrite a developer's own MCP registrations. Both are per-developer settings,
so they come out of the managed path entirely and stay with the commands that own them, ucode mcp
and ucode skills.

• Managed manifests no longer carry MCP servers or skills, and the authoring wizard no longer asks
  for them.
• ucode skills moves out from under ucode configure, since it configures nothing managed.
• Net effect is about 1200 lines deleted: the managed MCP and skills reconciliation logic plus the
  tests that only existed to cover it.
• Reviewer focus: the upgrade path in src/ucode/mcp.py that unregisters servers a previous managed
  config had installed and then drops the managed_mcp_servers marker. That is the only part of this
  PR that touches a developer's existing state rather than just deleting code. Two things about it
  are load-bearing. It diffs from the marker list, not from the developer's mcp_servers, because
  the old apply path deliberately kept managed servers out of that list. And it narrows the work to
  agents whose CLI is still on PATH: a marker outlives the agent it names, unregistering shells out
  to that agent's CLI, and this runs on the launch path, so a marker naming a since-uninstalled agent
  would otherwise take down every launch with a FileNotFoundError before the agent the developer
  actually asked for ever starts, markers still in place so the next launch fails the same way.

How do you know it works?

The MCP, skills, wizard, and CLI suites were reworked to the new boundary, including cases for the
upgrade path above: markers naming a mix of installed and uninstalled agents, markers naming only
uninstalled agents, and the skills variant. Each was checked against the unfixed source first and
fails there, so they exercise the launch crash rather than restating current behavior. Full unit
suite green locally at this layer, with one pre-existing exception, test_e2e_user_agent.py's
gateway assertion, which fails identically without this PR's changes applied. The total test count
drops relative to main because the tests for the removed managed MCP and skills path are deleted
with it.