Merge harness hardening: security guardrails, DX commands, release channels, MCP scaffold

config/company.json

@@ -8,5 +8,6 @@
     "не пушить в main",
     "MR обязателен"
   ],
-  "remoteConfigUrl": null
+  "remoteConfigUrl": null,
+  "auditEndpoint": null
 }

config/mcp.json

@@ -0,0 +1,35 @@
+{
+  "//": "MCP server registry consumed by extensions/mcp-bridge.ts. All servers are DISABLED by default — enable one, set its token env var, then restart pi. URLs are pulled from config/company.json (single source of truth); tokens from env. Templates: {config:KEY} → company.json value, {env:VAR} → environment variable. Requires VPN/creds and the launcher (uvx/npx) to actually connect.",
+  "servers": {
+    "jira": {
+      "enabled": false,
+      "description": "Jira (Server/DC) через mcp-atlassian (Python, запускается uvx)",
+      "command": "uvx",
+      "args": ["mcp-atlassian"],
+      "env": {
+        "JIRA_URL": "{config:trackerUrl}",
+        "JIRA_PERSONAL_TOKEN": "{env:JIRA_TOKEN}"
+      }
+    },
+    "confluence": {
+      "enabled": false,
+      "description": "Confluence (Server/DC) через mcp-atlassian",
+      "command": "uvx",
+      "args": ["mcp-atlassian"],
+      "env": {
+        "CONFLUENCE_URL": "{config:docsUrl}",
+        "CONFLUENCE_PERSONAL_TOKEN": "{env:CONFLUENCE_TOKEN}"
+      }
+    },
+    "gitlab": {
+      "enabled": false,
+      "description": "GitLab (self-hosted) через @zereight/mcp-gitlab (запускается npx)",
+      "command": "npx",
+      "args": ["-y", "@zereight/mcp-gitlab"],
+      "env": {
+        "GITLAB_API_URL": "https://{config:gitHost}/api/v4",
+        "GITLAB_PERSONAL_ACCESS_TOKEN": "{env:GITLAB_TOKEN}"
+      }
+    }
+  }
+}