fix(mcp): ignore project allowlist overrides for env expansion

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

src/plugin-config.ts

@@ -210,8 +210,9 @@ export function loadPluginConfig(
   }
 
   // Load user config first (base). Parse empty config through Zod to apply field defaults.
+  const userConfig = loadConfigFromPath(userConfigPath, ctx)
   let config: OhMyOpenCodeConfig =
-    loadConfigFromPath(userConfigPath, ctx) ?? OhMyOpenCodeConfigSchema.parse({});
+    userConfig ?? OhMyOpenCodeConfigSchema.parse({});
 
   // Override with project config
   const projectConfig = loadConfigFromPath(projectConfigPath, ctx);
@@ -221,6 +222,7 @@ export function loadPluginConfig(
 
   config = {
     ...config,
+    mcp_env_allowlist: userConfig?.mcp_env_allowlist ?? [],
   };
 
   log("Final merged config", {