fix(bin): gate agent-native MCP startup for Codex spawns

[tommy230]

Intent

Keep agent-native MCP clients globally configured and available for agent-native repositories, while firstmate-spawned Codex tasks for unrelated repositories disable only the two agent-native MCP servers per launch. Verify the final PR branch after the commit-subject cleanup.

What Changed

• Updates Codex spawn handling so non-agent-native project worktrees disable only the two agent-native MCP servers per launch, while agent-native repositories keep those MCP clients available.
• Adds regression coverage for Codex launch behavior across regular projects, agent-native projects, and secondmate launches.
• Syncs README and AGENTS documentation with the contextual Codex MCP launch rules.

Risk Assessment

✅ Low: The change is narrowly scoped to Codex launch-time MCP overrides with matching behavior coverage and no material review findings.

Testing

Inspected the target diff and commit, ran the focused Codex spawn and secondmate regression tests, captured reviewer-visible fake-tmux launch transcripts proving the MCP override behavior end-to-end, and confirmed the worktree was clean afterward.

Evidence: Codex MCP launch evidence

Evidence for contextual Codex MCP launch overrides
Generated: 2026-06-24

alpha launch line (non-agent-native repo; should disable only two agent-native MCP servers):
send-keys -t firstmate:fm-codex-launch-z1 -l codex --dangerously-bypass-approvals-and-sandbox -c mcp_servers.agent-native-web-production-e480f.enabled=false -c mcp_servers.agent-native-dispatch.enabled=false -c "notify=[\"bash\",\"-c\",\"touch '/var/folders/kg/vqcvwwlx3xs4wblm4wpvpkz00000gn/T//fm-spawn-codex-evidence.l8uL7e/alpha-home/state/codex-launch-z1.turn-ended'\"]" "$(cat '/var/folders/kg/vqcvwwlx3xs4wblm4wpvpkz00000gn/T//fm-spawn-codex-evidence.l8uL7e/alpha-home/data/codex-launch-z1/brief.md')"

agent-native-main launch line (agent-native repo; should keep agent-native MCP servers globally available, no disable flags):
send-keys -t firstmate:fm-codex-launch-z1 -l codex --dangerously-bypass-approvals-and-sandbox -c "notify=[\"bash\",\"-c\",\"touch '/var/folders/kg/vqcvwwlx3xs4wblm4wpvpkz00000gn/T//fm-spawn-codex-evidence.l8uL7e/agent-native-main-home/state/codex-launch-z1.turn-ended'\"]" "$(cat '/var/folders/kg/vqcvwwlx3xs4wblm4wpvpkz00000gn/T//fm-spawn-codex-evidence.l8uL7e/agent-native-main-home/data/codex-launch-z1/brief.md')"

Evidence: Non-agent-native launch line

send-keys -t firstmate:fm-codex-launch-z1 -l codex --dangerously-bypass-approvals-and-sandbox -c mcp_servers.agent-native-web-production-e480f.enabled=false -c mcp_servers.agent-native-dispatch.enabled=false -c "notify=[\"bash\",\"-c\",\"touch '/var/folders/kg/vqcvwwlx3xs4wblm4wpvpkz00000gn/T//fm-spawn-codex-evidence.l8uL7e/alpha-home/state/codex-launch-z1.turn-ended'\"]" "$(cat '/var/folders/kg/vqcvwwlx3xs4wblm4wpvpkz00000gn/T//fm-spawn-codex-evidence.l8uL7e/alpha-home/data/codex-launch-z1/brief.md')"

Evidence: Agent-native launch line

send-keys -t firstmate:fm-codex-launch-z1 -l codex --dangerously-bypass-approvals-and-sandbox -c "notify=[\"bash\",\"-c\",\"touch '/var/folders/kg/vqcvwwlx3xs4wblm4wpvpkz00000gn/T//fm-spawn-codex-evidence.l8uL7e/agent-native-main-home/state/codex-launch-z1.turn-ended'\"]" "$(cat '/var/folders/kg/vqcvwwlx3xs4wblm4wpvpkz00000gn/T//fm-spawn-codex-evidence.l8uL7e/agent-native-main-home/data/codex-launch-z1/brief.md')"

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• git diff --stat e2e730f8e7139e385a6eee3352eea1db9da6adeb..4eb9e5bd3e69a0791e4c2596e9c6dcee548269f4 && git diff --name-only e2e730f8e7139e385a6eee3352eea1db9da6adeb..4eb9e5bd3e69a0791e4c2596e9c6dcee548269f4
• git show --stat --oneline --decorate HEAD && git log --oneline -5
• tests/fm-spawn-codex.test.sh
• tests/fm-secondmate.test.sh
• Manual evidence capture with fake tmux: spawned Codex for projects/alpha and projects/agent-native-main, then saved the generated launch lines under /var/folders/kg/vqcvwwlx3xs4wblm4wpvpkz00000gn/T/no-mistakes-evidence/01KVWXXTCS15JZDH0DHEH8ACPS
• find /var/folders/kg/vqcvwwlx3xs4wblm4wpvpkz00000gn/T/no-mistakes-evidence/01KVWXXTCS15JZDH0DHEH8ACPS -maxdepth 1 -type f -print | sort
• git status --short

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.