fix: harden plugin trust defaults

[hopeatina]

Summary

• make agent suite provisioning opt-in by default
• make MCP client autoconfig opt-in by default
• remove legacy dev credential fallback from the shipped plugin
• add explicit security and transparency docs for local writes, credentials, network calls, telemetry, and watchdog behavior
• remove stale dashboard labels for the removed legacy key source

Test plan

• npm run typecheck
• npm run build

Rollout notes

• npm publish for 0.7.30 is ready but still requires an npm OTP at publish time
• ClawHub publish from the packed artifact no longer hits the 20 MB upload limit, but the CLI is still hanging after Preparing; package metadata has not updated yet