feat: deprecate features.mcp-cli, enable MCP CLI mounting by default

[Copilot]

features.mcp-cli: true was required alongside tools.mount-as-clis: true to activate MCP CLI mounting. The feature flag gate is removed — MCP CLI mounting is now always active. mount-as-clis: true is still required to mount user-facing servers; safeoutputs/mcpscripts continue to be always-mounted when enabled.

Code changes

• mcp_cli_mount.go — Remove isFeatureEnabled(MCPCLIFeatureFlag) gate from getMCPCLIServerNames(); remove feature flag synthesis from buildCLIWorkflowDataForMounts() (only existed to satisfy the gate)
• features_validation.go — Emit deprecation warning at compile time when features.mcp-cli is explicitly set
• feature_constants.go — MCPCLIFeatureFlag marked deprecated in doc comment

Test / workflow updates

• Removed MCPCLIFeatureFlag: true from test fixtures in copilot_engine_test.go, crush_engine_test.go, codex_engine_test.go; updated one expected output (comprehensive with multiple tools) to include shell(safeoutputs:*) now injected by default when safeoutputs is configured with restricted bash
• Removed mcp-cli: true from all 162 workflow .md files; cleaned up 118 resulting empty features: sections; recompiled all 202 lock files

Before / after

# Before — required both flags
features:
  mcp-cli: true   # ← no longer needed, emits deprecation warning if present
tools:
  mount-as-clis: true

# After — just mount-as-clis is sufficient
tools:
  mount-as-clis: true

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.