feat(codex): mcp add/list/remove subcommands #37

Post-MVP follow-up to #13. Net-new pattern — claude's MCP surface is read-only flag-driven (--mcp-config); codex has a CRUD surface backed by mutating ~/.codex/config.toml.

Scope

Add three subcommands under cmd/codex/mcp/:

• codex mcp add <name> <transport-config> — adds an entry to [mcp_servers] in the TOML.
• codex mcp list — prints the current [mcp_servers] entries.
• codex mcp remove <name> — deletes an entry.

Design questions for the issue body to resolve before coding

1. Persistence. Does testagent actually mutate ~/.codex/config.toml on the user's filesystem, or treat all three as accept-and-no-op (print what would have been written, exit 0)? Recommendation: no-op. testagent is a fake; persisting state across runs is out of scope for orchestrator E2E tests, which want determinism.
2. Output format. Real codex's mcp list output shape — match byte-for-byte? Verify against the binary.
3. Validation. Does mcp add validate the transport config? Recommendation: parse-only validation, no I/O.

Non-goals

• Real MCP server connectivity from these subcommands. internal/mcp.Client already handles connection during a session; these subcommands are config-management surface, not session surface.
• Backporting any of this to claude.

Sequencing

After #13 MVP ships (which establishes the TOML loader).