feat: add MCP import and product customization foundations

[limityan]

Summary

This PR delivers two independently designed C0a slices in one reviewable change:

• add explicit, preview-first MCP import for safe OpenCode and Claude Code declarations through the existing external-source and MCP configuration owners, exposed in Desktop and the root CLI;
• add a strict JSONC product-definition resolver shared by Desktop and CLI builds, with independently localized names and binary identity for each family member.

Boundaries

MCP import reuses the current runtime and config owner. Imports are disabled by default, use sanitized public plans, fail closed on unsupported/unknown fields, and write through snapshot CAS. It does not add a second MCP runtime, cache, journal, undo flow, TUI flow, credential migration, Peer/Remote mutation, or Codex import projection.

Product customization is an architecture foundation, not a complete white-label system. Schema v1 contains only fields consumed by the Desktop or CLI build path. It intentionally defers logos/assets, GUI/TUI layout, bundled extensions, Installer/App Store targets, signing/update identity, data isolation, and repository-wide runtime branding. No general product manifest or unused projection is emitted.

Documentation

• keep durable MCP import and product-resolution contracts in their existing owner architecture documents; no standalone delivery spec is added;
• synchronize the CLI product-line, OpenCode adapter, and root/CLI contributor guidance with the implemented commands and current boundaries;
• document preview/apply behavior, disabled native MCP entries, unsupported source fields, and deferred Codex/undo/target-layer work;
• document family-wide product validation, selected-member assembly, standard Cargo target triples, and wrapper-owned target-directory isolation.

Verification

• pnpm run product:test (17/17)
• pnpm run product:check
• focused Web MCP/API tests (44/44)
• pnpm run type-check:web
• pnpm run i18n:audit
• focused OpenCode and MCP service contract tests
• cargo check --workspace on rebased a1d582a1f
• node scripts/check-core-boundaries.mjs
• pnpm run check:repo-hygiene
• pnpm run check:github-config
• custom Acme CLI build/help smoke (Usage: acme)

An isolated adversarial review was repeated after fixes, after rebasing onto the latest upstream main, and after consolidating the standalone spec into owner documents; no P0/P1/P2 blockers remain.