Register MCP servers through the installer

An MCP server is a URL plus a bearer token, and the token is why this is a
stage rather than a manifest line. Panama is public, so the tokens cannot
live in it, and neither runtime keeps its server list in a file worth
symlinking: Codex writes them into config.toml beside dozens of unrelated
settings, and Claude Code into ~/.claude.json. link-mcp registers them
through the runtime's own CLI instead.

user/agents/mcp/servers is tracked and names which variable carries each
token. user/agents/mcp/env holds the tokens and is ignored. A new machine
gets the servers by dropping its own env file beside the tracked one.

Only Claude Code is handled, and only where the interview enabled personal
content. Rewriting a section of somebody's live Codex TOML is a worse
failure mode than leaving two lines to paste once.

user/agents/mcp/servers

@@ -0,0 +1,21 @@
+# MCP servers registered with the local agent runtimes.
+#
+#   <name>  <transport>  <url>  <token variable>
+#
+# The token variable names an entry in user/agents/mcp/env, which is ignored by
+# git. This file carries no secret, so it is tracked like the rest of user/ and
+# a new machine gets the same servers by dropping its own env file beside it.
+#
+# A row with no token variable registers without an Authorization header.
+#
+# Lines beginning with # are comments and blank lines are ignored.
+
+# The NanoKVM boards. These give an agent full console control of each machine,
+# including the parts SSH cannot reach: firmware, a locked screen, and the GUI
+# prompts Xcode and the keychain raise during a signed iOS build.
+nanokvm-fedora  http  https://nano.gbrown.org/api/mcp     NANOKVM_FEDORA_TOKEN
+nanokvm-mac     http  https://macnano.gbrown.org/api/mcp  NANOKVM_MAC_TOKEN
+
+# Bill Tracker's hosted MCP server. No token: it is an OAuth server of its own
+# and Claude Code signs in through Gib's Auth on first use.
+bill-tracker    http  https://mcp.billtracker.gbrown.org/mcp