MCP runtime policy does not normalize names or enforce an empty allowlist

## Summary

MCP server policy is evaluated differently by the CLI command path and the runtime `McpClientManager` path. As a result, servers can be started when `mcp.excluded` or an explicit empty `mcp.allowed` should block them, while valid case-insensitive allowlist entries can be rejected.

## Reproduction

1. Configure an MCP server named `probe`.
2. Use any of the following policy configurations:

```json
{ "mcp": { "allowed": ["PROBE"] } }
```

```json
{ "mcp": { "excluded": [" probe "] } }
```

```json
{ "mcp": { "allowed": [] } }
```

## Expected behavior

- `PROBE` should allow `probe`, matching the documented case-insensitive policy behavior.
- `excluded: [" probe "]` should block `probe`.
- An explicit empty allowlist should block every MCP server.

## Actual behavior

`McpClientManager` uses exact `includes()` matching and only evaluates non-empty arrays. The first case is incorrectly blocked, while the latter two are incorrectly allowed at runtime. The CLI `canLoadServer()` path already normalizes names and treats an empty allowlist as fail-closed.

## Impact

The displayed policy status and the server startup behavior can diverge. In particular, a locally configured stdio MCP server may start even though the user explicitly excluded it or configured an empty allowlist.

I will prepare a fix and submit a PR for this issue.

Start by comparing the runtime McpClientManager policy evaluation with the CLI canLoadServer() path, using the three configurations in the issue as reproductions. Confirm that name matching is case-insensitive and trims whitespace, and that an explicit empty allowlist blocks every server. Done means runtime startup and displayed policy status agree for these cases.

Written by the indexing model from the issue text.