fix(external-sources): clarify MCP and agent reviews

[limityan]

Summary

• keep pending MCP reviews compact while leaving the command or remote URL and a concise execution/data risk warning visible before approval
• keep working directory, environment, header, and full configuration details behind an explicit disclosure, and associate the risk note with the enable action for assistive technology
• report exact unavailable tool names and setting-specific OpenCode agent diagnostics while preserving older host and snapshot compatibility

Verification

• cargo test -p bitfun-product-domains --features external-sources --test external_source_contracts (36 passed)
• pnpm --dir src/web-ui run test:run src/infrastructure/config/components/ExternalSourcesConfig.test.tsx (45 passed)
• pnpm run type-check:web
• pnpm run i18n:audit
• pnpm run theme:color-audit:all
• node scripts/check-core-boundaries.mjs
• pnpm run check:repo-hygiene
• git diff --check

A broad workspace/Core compile was intentionally not run locally because this is a focused change; CI remains the compilation gate.