feat(hub): pass execution MCP servers to agents (#2813)

* feat(hub): pass execution MCP servers to agents

Hub-owned execution capabilities need to reach provider sessions without becoming part of outward agent snapshots. Keep the configuration daemon-private so provider recovery continues to work.

* fix(hub): protect daemon MCP namespace

Hub execution MCP configuration must not replace the daemon-owned Paseo server. Validate only after owned-record lookup so idempotent replay remains stable while new launches fail before provider or durable state creation.

* fix(agent): reject unsupported MCP launches

* fix(agent): scope MCP support guard

* fix(agent): redact MCP metadata from wire payloads

* fix(agent): validate MCP support on restored sessions

* fix(session): rehydrate MCP config on resume

* fix(session): resume newest matching agent record

* fix(session): restore archive state after failed resume

docs/hub.md

@@ -45,8 +45,11 @@ replays the original prompt. A duplicate create returns the existing agent witho
 turn.
 
 Hub creates use the same agent creation path as trusted clients. They may select any existing
-worktree target shape. Execution completion policy remains outside the daemon: a completed agent
-turn does not imply that the Hub execution is terminal.
+worktree target shape and carry optional MCP server configuration for the agent session. The daemon
+keeps that configuration in its private agent record so provider sessions can recover after a
+restart; neither ordinary client snapshots and updates nor Hub projections expose session
+configuration. Execution completion policy remains outside the daemon: a completed agent turn does
+not imply that the Hub execution is terminal.
 
 The Hub ends an execution by sending `hub.execution.control.request` with the durable execution ID
 and either `interrupt` or `archive`. The daemon resolves the agent from the authenticated daemon