feat(mcp): add agentgate-mcp stdio server

[shreyanshjain7174]

What

Adds cmd/agentgate-mcp. It is a stdio MCP server that exposes one tool, github_list_repos.
The tool calls POST /v1/act through pkg/sdk. The agent only holds a scoped AgentGate key. It never sees the OAuth token.

• Env: AGENTGATE_AGENT_KEY (required), AGENTGATE_URL (default http://localhost:8080).
• AGENTGATE_URL must be HTTPS, or HTTP on localhost/127.0.0.1/::1. URLs with userinfo are rejected.
• Methods: initialize, ping, tools/list, tools/call. Notifications are ignored. Unknown methods get -32601.
• on_behalf_of is required. Unknown argument fields are rejected with -32602.
• Gateway errors come back as isError: true tool results, not JSON-RPC errors.
• Diagnostics go to stderr only. stdout carries JSON-RPC only. The key is never logged.

Imports only pkg/sdk and the stdlib. Code comes from the phase 12/13 local snapshot, unchanged.

Validation

• CGO_ENABLED=1 go build ./... ok
• go vet ./... ok
• gofmt -l . empty
• go test ./cmd/agentgate-mcp/... ./pkg/sdk/... -race ok
• go test ./... ok, all packages
• Smoke: built the binary, piped initialize, notifications/initialized, tools/list, tools/call, and a bad line, with AGENTGATE_URL=https://bogus.invalid. Got 4 responses, exit 0. tools/call returned isError: true with a DNS error. Bad line returned -32700. The test key string did not appear in stdout or stderr.
• Plain HTTP to a non-local host exits 1. A missing key exits 1.