fix(mcp): restrict env var expansion in MCP configs

Block sensitive env var interpolation in MCP config expansion so repo and plugin MCP definitions cannot exfiltrate secrets by default.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

src/features/claude-code-mcp-loader/configure-allowed-env-vars.ts

@@ -0,0 +1,24 @@
+const BUILTIN_ALLOWED_MCP_ENV_VARS = ["PATH", "HOME", "USER", "SHELL", "TERM"]
+const SENSITIVE_MCP_ENV_VAR_PATTERN = /KEY|TOKEN|SECRET|PASSWORD|AUTH|CREDENTIAL/i
+
+let additionalAllowedMcpEnvVars = new Set<string>()
+
+export function getAllowedMcpEnvVars(): Set<string> {
+  return new Set([...BUILTIN_ALLOWED_MCP_ENV_VARS, ...additionalAllowedMcpEnvVars])
+}
+
+export function isSensitiveMcpEnvVar(varName: string): boolean {
+  return SENSITIVE_MCP_ENV_VAR_PATTERN.test(varName)
+}
+
+export function isAllowedMcpEnvVar(varName: string): boolean {
+  return getAllowedMcpEnvVars().has(varName)
+}
+
+export function setAdditionalAllowedMcpEnvVars(varNames: string[]): void {
+  additionalAllowedMcpEnvVars = new Set(varNames)
+}
+
+export function resetAdditionalAllowedMcpEnvVars(): void {
+  additionalAllowedMcpEnvVars = new Set()
+}