Marketplace-synced plugin drops oauth.clientId from bundled .mcp.json (manual connector add of same clientId works)

### What happened?

A plugin published through a GitHub-based plugin marketplace (claude.ai admin → Plugin marketplace → Sync from GitHub) declares an HTTP MCP server in its bundled `.mcp.json` with an `oauth` block containing a pre-registered static `clientId`.

After sync, the MCP server config that appears on a user's Claude Desktop has only `type` + `url`. The `oauth.clientId` and `oauth.callbackPort` fields are silently dropped.

When the user clicks **Connect**, claude.ai falls back to RFC 7591 Dynamic Client Registration against the gateway's `registration_endpoint`. Our IdP (AWS Cognito user pools) does not support DCR, so the flow fails immediately with `redirect_mismatch` on a client_id we did not declare.

**Manually adding the same MCP server via Settings → Connectors → "Add custom connector" using the identical `clientId` value works end-to-end** against the same gateway. So the gateway / IdP / scopes / callback URLs are correctly configured — the bug is specifically the marketplace sync path stripping the `oauth` block.

### What did you expect to happen?

Either:

1. The `oauth.clientId` (and `callbackPort`) declared in the plugin's `.mcp.json` is preserved through marketplace sync, so the user's Connect click uses that pre-registered client.
2. Or the docs / `.mcp.json` schema clearly state this is unsupported and describe the supported plugin-bundled OAuth path for IdPs without DCR.

We accept that OAuth is user-initiated (per #286 — not asking for auto-OAuth). We just need the static `clientId` we explicitly declared to survive the sync so the user's Connect click can use it.

### Steps to reproduce

1. Create a plugin marketplace repo with a plugin whose `.mcp.json` declares:
```json
{
"mcpServers": {
"example-mcp": {
"type": "http",
"url": "https://example.gateway.us-east-1.amazonaws.com/mcp",
"oauth": {
"clientId": "your-pre-registered-pkce-client-id",
"callbackPort": 41234
}
}
}
}
```
2. Connect the marketplace repo via claude.ai admin → Plugin marketplace → Sync from GitHub.
3. Provision the plugin to a user.
4. On the user's Claude Desktop, inspect the synced connector — `oauth.clientId` is absent.
5. Click **Connect** — claude.ai attempts DCR against the gateway's `.well-known/oauth-authorization-server` `registration_endpoint`. Against a Cognito user pool (no DCR), the flow fails before reaching the IdP login page.
6. As a control, manually add the same MCP server via Settings → Connectors → "Add custom connector", pasting the identical `clientId`. OAuth completes successfully against the same gateway.

### Area

OAuth / Authentication (also affects MCP Connector / Plugin Marketplace sync)

### MCP Server (if applicable)

Internal HTTP MCP server fronted by AWS Bedrock AgentCore Gateway. JWT authorizer backed by AWS Cognito user pool (public/PKCE client, redirect `https://claude.ai/api/mcp/auth_callback` allowlisted). Cognito does **not** expose RFC 7591 DCR.

### Error messages or logs

```
https://auth./error?error=redirect_mismatch&client_id=
```

The `client_id` in this redirect is generated by claude.ai's DCR fallback — it is not the value we declared in `.mcp.json`.

### Additional context

- Related: #286 — auto-OAuth on install is intentional. This is a different ask: preserve the explicitly declared static `clientId` so manual Connect click works without DCR.
- Workaround in use today: every affected user manually re-adds the connector through Settings → Connectors. That defeats the marketplace's purpose and is painful for non-engineer users.
- Things we already tried (in case relevant — all changed the gateway URL, the Cognito client_id, the plugin name, and even the marketplace + GitHub repo wholesale; every sync still strips `oauth`):
- Renamed the plugin (`index-mcp` → `index-admin-mcp`)
- Rotated the Cognito client_id (V1 → V2)
- Recreated the AgentCore gateway entirely to get a new URL
- Created a brand-new marketplace + plugin under a new GitHub repo
- IdP: AWS Cognito user pool, public PKCE client, no DCR (Cognito doesn't support it).