feat(mcp): MCP client foundation (Phase 4.2)

[flg77]

Summary

Adds the symbiote layer that complements the in-house Skills package from PR 4.1. Where Skills are organelles the cell synthesises, MCP servers are external symbionts the cell admits through a governed membrane (allowed_mcps whitelist).

This PR wires the client surface only. PR 4.3 grafts it onto RoleDefinitionConfig and CognitiveCore; PR 4.4 surfaces it in the TUI Ecosystem screen.

What's in the box

acc/mcp/ — new package

Module	Role
manifest.py	MCPManifest pydantic model. Transport enum (http / stdio), per-transport field-set validation (http demands url, stdio demands command), tool allow/deny lists with is_tool_allowed(), risk_level + requires_actions governance hooks, lowercase-snake_case server_id validator.
errors.py	MCPError → {ManifestError, ServerNotFound, ToolNotFound, Connection, Protocol, Transport}. Shape mirrors the acc.skills error tree so contributors learn one pattern.
client.py	MCPClient — JSON-RPC 2.0 envelope (monotonic id allocator), MCP initialize + tools/list + tools/call methods, cached tool advertisement (refreshable), bearer auth via api_key_env, lazy connection on first call, idempotent initialize().
registry.py	MCPRegistry — same load_from() / manifest() / list_server_ids() surface as SkillRegistry, plus client(server_id) lazy instantiation with HTTP-connection caching across hot-reloads when the manifest is unchanged. close_all() releases connections during agent shutdown.

mcps/ — directory convention

• mcps/_base/{mcp.yaml, README.md}: defaults document + minimum-manifest walkthrough + transport status table + tool sandbox rules + risk-level mapping + governance-hook reference.
• mcps/echo_server/mcp.yaml: stub diagnostic manifest pointing at a hypothetical local echo server (acc-mcp-echo:8080). No server process is shipped here; the manifest exists so the loader has one row to validate against, and so the TUI Ecosystem screen (PR 4.4) is never empty on a fresh checkout.

Transport status

Transport	Status (this PR)	Notes
http	implemented	JSON-RPC 2.0 over HTTP POST. Production path.
stdio	reserved	Manifest enum accepts the value; the client raises NotImplementedError if used. Subprocess-pipe transport will land in a follow-up PR.

Round-trip smoke tests (run locally — all green)

• Loader discovery + deep-merge: 1 server loaded as expected.
• Tool allow/deny gating: blocks forbidden names client-side.
• Manifest validation: http transport without url raises ValidationError; stdio without command raises ValidationError.
• JSON-RPC envelope: against a mocked httpx, initialize → tools/list → tools/call returns expected payload, manifest-filtered tools are not advertised, manifest-blocked invocations raise MCPToolNotFoundError.

# Reproduce loader test
python -c "
from acc.mcp import MCPRegistry
reg = MCPRegistry(); reg.load_from('mcps')
print(reg.list_server_ids())                 # ['echo_server']
print(reg.manifest('echo_server').url)       # http://acc-mcp-echo:8080/rpc
"

Test plan

• Pull and confirm `from acc.mcp import MCPRegistry` imports cleanly.
• Run the loader smoke-test above on lighthouse — should print `['echo_server']`.
• Verify `mcps/echo_server/mcp.yaml` round-trips through the deep-merge with `mcps/_base/mcp.yaml`.
• Confirm no behaviour change for existing agents (none of them import `acc.mcp` yet — PR 4.3 wires it in).

Out of scope for this PR

• RoleDefinitionConfig fields (allowed_mcps) — comes in PR 4.3.
• Cat-A rule A-018 enforcement — comes in PR 4.3.
• CognitiveCore invocation surface — comes in PR 4.3.
• TUI Ecosystem live tables — comes in PR 4.4.
• Stdio transport implementation — separate follow-up PR.
• Real echo MCP server image — separate follow-up PR.