feat(mcp): real echo MCP server image — makes mcps/echo_server operational

[flg77]

Summary

Ships the diagnostic JSON-RPC echo server that backs mcps/echo_server/mcp.yaml. Until now the manifest was a fixture: it round-tripped through the loader, lit up the TUI Ecosystem row, and let `coding_agent` allow-list `echo_server` — but agents dispatching `[MCP: echo_server.echo {...}]` markers got `connection refused`, and the manual smoke recipe in PR #20's prompt-pane help had to inject synthetic events.

After this PR, a single env flag spins up a real server:

```bash
MCP_ECHO=true ./acc-deploy.sh up
```

…and `coding_agent`'s LLM-emitted MCP markers actually round-trip through a real container.

What lands

File	Change
`container/production/echo_mcp_server/main.py` (new)	Tiny stdlib-only Python server. Implements exactly the three JSON-RPC methods `acc.mcp.client.MCPClient` exercises: `initialize`, `tools/list`, `tools/call`. No Flask / aiohttp / external pip deps.
`container/production/Containerfile.echo-mcp-server` (new)	UBI10 python-312-minimal base. ~1 MB layer on top of the base (no pip installs). Non-root UID 1001, EXPOSE 8080, healthcheck via stdlib urllib so we don't ship curl.
`container/production/podman-compose.yml`	New `acc-mcp-echo` service behind `--profile mcp-echo`. Container name matches the hostname in the manifest URL → zero manifest edits required.
`acc-deploy.sh`	New `MCP_ECHO` env var (default false). Auto-attaches the profile on `build`/`rebuild` so the image is baked even when the operator doesn't opt in at `up` time.
`mcps/echo_server/mcp.yaml`	Header rewritten — no longer "stub example". Includes the manual-smoke recipe.
`tests/test_echo_mcp_server.py` (new)	8 cases.

Tests (8 new, all green)

Group	Cases
Pure dispatch	initialize / tools/list / tools/call echo / unknown tool / wrong arg type / unknown method / id always echoed (int / str / "" / None)
End-to-end	Real `HTTPServer` on `127.0.0.1:` in a background thread, driven via `acc.mcp.client.MCPClient` with a real `MCPManifest` — confirms wire-format compatibility on both sides

Combined regression: 265 passed locally on Windows
(test_echo_mcp_server + test_mcp_stdio_transport + the four coding_agent tier files + test_task_progress_* + prompt-pane suite + redis-compat + telemetry + ecosystem + file-picker + config + role-store + guardrails + compliance, with `TestEd25519Validation` deselected for the lighthouse OpenSSL platform limit).

Test plan

• `pytest tests/test_echo_mcp_server.py -v --no-cov` → 8 passed
• Combined regression → 265 passed
• `bash -n acc-deploy.sh` → syntax OK
• Manual on acc1 post-merge (when SSH is back):
  ```bash
  MCP_ECHO=true ./acc-deploy.sh rebuild
  MCP_ECHO=true ./acc-deploy.sh up
  podman ps # acc-mcp-echo healthy
  curl http://acc-mcp-echo:8080/ # banner reachable from agent net
  ./acc-deploy.sh cli nats sub 'acc.sol-01.>' &

  Send a prompt via screen 7 that yields [MCP: echo_server.echo {"text":"X"}]

  → response carries the canonical {content:[{type,text,X}]} envelope

  ```

acc1 verification

Still deferred — SSH timeout to `10.199.12.91:22` since PR #21 (3 PRs ago). Tests are pure-Python + stdlib HTTP, no platform-specific code; the local Windows result transfers cleanly when the host is back.

Out of scope (future enhancements)

• Resources / prompts methods (the MCP spec covers more than tools; ACC only consumes tools today).
• HTTPS / mTLS — diagnostic server, host-network only.
• SSE / streamable HTTP transport — current ACC HTTPTransport posts one JSON-RPC envelope per request; SSE would require wiring on the client side too.