chore(mcp): remove Inspector sandbox_proxy workaround

.oxfmtrc.jsonc

@@ -1,14 +1,6 @@
 {
   "$schema": "./node_modules/oxfmt/configuration_schema.json",
-  "ignorePatterns": [
-    ".changeset/*.md",
-    "**/__generated__/**",
-    "schema.graphql",
-    "pnpm-lock.yaml",
-    // Vendored verbatim from upstream so `curl | diff` can prove it has not
-    // drifted; reformatting its inline script would defeat that check.
-    "scripts/lib/inspector-sandbox-proxy.html"
-  ],
+  "ignorePatterns": [".changeset/*.md", "**/__generated__/**", "schema.graphql", "pnpm-lock.yaml"],
   "printWidth": 100,
   "tabWidth": 2,
   "semi": true,

packages/mcp/README.md

@@ -510,8 +510,6 @@ A view's document is read once, when the app's sandbox iframe mounts, and never
 
 Two things must be true for that reopen to show new markup, and both are handled for you. The server has to read the view from disk rather than the copy inlined at build time, and it has to actually receive `TRANSCEND_MCP_DEV_VIEWS` — which exporting it cannot achieve, because the Inspector spawns a stdio server with an allowlisted environment (`HOME`, `LOGNAME`, `PATH`, `SHELL`, `TERM`, `USER`) plus only what its `-e KEY=VALUE` flag supplied. `pnpm mcp:inspect` passes the flag. The same allowlist drops API credentials, and we deliberately leave them out rather than exposing them in a command line every local process can read, so use `--http` when a tool needs to reach the Transcend API: there we spawn the server ourselves and it inherits the environment normally.
 
-One workaround runs before launch. v2's published tarball omits `clients/web/static/sandbox_proxy.html`, the document that hosts the app's iframe, so opening an app renders `Sandbox not loaded: ENOENT ...` inside the app frame — a missing file that looks like a broken view. `pnpm mcp:inspect` restores it from a vendored copy of upstream's file and logs a line when it does. It is a workaround for [inspector#1859](https://github.com/modelcontextprotocol/inspector/issues/1859), tracked by a `TODO` in [`scripts/lib/mcp-app-dev.ts`](../../scripts/lib/mcp-app-dev.ts) to delete once a release ships the file; an install that already has the document is left alone. Because the Inspector reads it once at startup, an instance that was already running when the file appeared keeps serving the error — restart it.
-
 #### When a view does not appear, check the capability gate first
 
 This is the failure that looks exactly like a broken view. A tool's `_meta.ui` is only attached when the client declared the MCP Apps extension: