[Epic]: Expand the opencode org-wide MCP catalog (GitHub + Python + token-gated batches)

## Executive Summary

We want to finish expanding the **org-wide opencode MCP catalog** (the `.well-known/opencode` config pushed to every user) because the first three batches shipped only the servers that were safe/low-friction to enable immediately, and several high-value capabilities were deliberately deferred. This epic exists to solve the gap between "what we researched as valuable for developers / marketing / product owners" and "what is actually wired up", without compromising the lean-primary + per-subagent security model.

## Strategic Intent

Land the remaining MCP capabilities (GitHub, the Python-backed servers, and the token-gated SaaS servers) as deliberate, individually-reviewed batches — each behind its own subagent — and prove the local-MCP model works on a real cluster.

## Problem Statement

- **Users (dev/marketing/PO):** GitHub (issues/PRs/projects), PDF handling, advanced search, Notion/Figma, and math are not available yet — these were the most-requested in the persona research.
- **Developers/operations:** GitHub has no usable npx server (official npm one deprecated → Go binary), so it needs a centralized gateway route + a GitHub App + a secret — non-trivial, cross-repo, and unprovisioned.
- **Security/governance:** every new server must keep the deny-baseline + per-subagent scoping; token-gated servers must not be turned on in a way that leaks or breaks for users without the key. The local-MCP env-passthrough + per-agent injection behavior has not yet been validated on-cluster.

## Desired Outcome

The catalog covers GitHub + the deferred Python/token-gated servers, each gated behind a dedicated subagent; the GitHub App + secrets are provisioned and documented; and per-agent tool injection + env passthrough are confirmed working live.

## Scope (In / Out)

### In Scope
- GitHub MCP via a centralized GitHub-App gateway `/mcp/github` route (ADR-0073 phase 2).
- The Python-backed batch: mem0, MCP-Mathematics, pdfmux (packaging decision: uvx vs. sidecar).
- The token-gated opt-in batch: Notion, Figma, Tavily/Exa, Sentry, 21st.dev Magic.
- Live validation of the local-MCP model (env passthrough + per-agent injection).

### Out of Scope
- Anything already shipped in #548 (ADR-0071/0072/0073 phase 1).
- Re-architecting the gateway `/mcp` mechanism (reused as-is).
- Per-user GitHub identity (the App route uses one shared service identity by decision).

## Source of truth (links)
- Merged groundwork: https://github.com/ADORSYS-GIS/ai-helm/pull/548
- ADR-0071/0072/0073 (`docs/adr/`), `docs/opencode-well-known.md`
- Research basis: persona MCP research (this session) — verified against npm 2026-06-29.

## Stakeholders
- Maintainer / accountable owner: @stephane-segning
- Consumers: all opencode org users (developers, marketing, product owners).

## Key Assumptions
- The gateway `/mcp` + Keycloak-JWT pattern (ADR-0038/0040) is reused for GitHub.
- `ai-helm-values` (private) holds per-env values + deps; secrets live in `ssegning-aws` (values-repo-first).

## Constraints
- GitHub App installation tokens expire hourly → need a refresher or PAT-style token.
- Token-gated local servers run on the user's laptop → keys come from the user's own env, not cluster ESO.
- Charts publish to OCI and float; chart logic here, deployed values in `ai-helm-values`.

## Risks
- Shared GitHub App identity loses per-user write attribution (acceptable for read).
- Python-backed servers add a new packaging surface (uvx/sidecar) to maintain.
- Turning token-gated servers on org-wide can produce noisy failures for keyless users (mitigated: scoped to subagents, fail only on delegation).

## Success metrics
- GitHub/Jira/Confluence/Notion reachable from opencode by the relevant subagents on the live cluster.
- Per-agent injection confirmed (primary carries none of the new tool schemas).

## Child Tickets
- (linked below as sub-issues)

## Human accountable owner
@stephane-segning

## AI Usage Declaration
AI (Claude Opus 4.8) drafted this epic from the session's research and the merged ADRs; the maintainer owns intent, verification, and consequences. No claim here is to be treated as truth without human verification.