fix(mcp): preserve user's enabled:false and apply disabled_mcps to all MCP sources

[edxeth]

Summary

• Fixes regression from 598a4389 where OMO force-enabled all MCPs, ignoring user's enabled: false in opencode.json
• Re-adds disabledMcps parameter to loadMcpConfigs() that was dropped during refactor
• Preserves user's enabled: false settings after MCP config merge
• Applies disabled_mcps filtering to all MCP sources (built-in, .mcp.json, and plugins)

Root Cause

Commit 598a4389 ("refactor(core): split index.ts and config-handler.ts into focused modules") extracted MCP config handling into mcp-config-handler.ts but:

1. Called loadMcpConfigs() without the disabledMcps parameter (originally added in fab0f462)
2. Did not handle the spread-order overwrite where .mcp.json MCPs (hardcoded enabled: true in transformer.ts) overwrote user's enabled: false from opencode.json

Changes

File	Change
loader.ts	Re-added disabledMcps: string[] = [] parameter; MCPs in the list are skipped during loading
loader.test.ts	3 new test cases for disabledMcps filtering
mcp-config-handler.ts	Captures user's enabled: false before merge, passes disabled_mcps to loader, restores enabled: false after merge, deletes disabled_mcps entries from final result
mcp-config-handler.test.ts	New file with 5 test cases

Verification

• Typecheck: clean (0 errors)
• All 66 MCP-related tests pass (0 failures)
• Full test suite: 2472 pass (70 pre-existing failures unrelated to changes)
• Manually verified: user confirmed fix works in production
• Oracle review: approved as safe and ship-ready

---

Summary by cubic

Fixes a regression that force-enabled MCPs. We now respect enabled:false in user config and apply disabled_mcps across built-in, .mcp.json, and plugin MCPs.

• Bug Fixes
  • Preserve enabled:false from opencode.json after merging with other MCP sources.
  • Re-add and pass disabledMcps to loadMcpConfigs to skip .mcp.json servers.
  • Apply disabled_mcps filtering to all MCP sources and remove them from the final config.
  • Add 8 tests covering these behaviors.

^{Written for commit 0dace5c. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Requires human review: 332 lines changed across 4 files with new feature (disabled_mcps filtering). Tests added but no coverage of edge cases like duplicate names across sources or case sensitivity. Cannot be 100% sure no =}