feat(acp): allow BUZZ_ACP_MCP_COMMAND to run several MCP servers

[noah-shipley-centric]

Problem

build_mcp_servers in crates/buzz-acp/src/lib.rs builds at most one McpServer, so an agent driven by buzz-acp can hold exactly one MCP server.

buzz-agent was never the constraint — McpRegistry::spawn_all takes a slice and already enforces MAX_MCP_SERVERS = 16. The ceiling of one exists only in this function.

That single slot forces a trade-off between reading and acting. Point an agent at a data MCP and it loses the tooling it replies with. I hit this with an agent wired to a remote data MCP: it made its tool calls correctly, then reasoned itself into a dead end mid-turn —

"I don't have shell access from the script sandbox ... there's no buzz tool exposed here directly ... I'll rely on just producing the final text reply."

— and produced no visible output at all, because the slot that had been carrying its dev tools now carried the data bridge. Nothing errored; the turn just quietly went nowhere.

Change

--mcp-command / BUZZ_ACP_MCP_COMMAND now accepts a comma-separated list:

BUZZ_ACP_MCP_COMMAND=/usr/local/bin/buzz-dev-mcp,/usr/local/bin/data-bridge

This mirrors --agent-args / BUZZ_ACP_AGENT_ARGS, which already uses value_delimiter = ',' in the same struct — so the parsing convention isn't new to the crate.

Backward compatible. The flag and env var keep their names, and a single value produces exactly the server it produced before. No existing configuration changes behaviour.

Two deliberate details:

• Blank entries are skipped. The "" default still yields no servers, and a stray trailing comma doesn't create a bogus one.
• Colliding file stems are disambiguated rather than fatal. Names come from the command's file stem and spawn_all rejects duplicates, so /opt/a/bridge + /opt/b/bridge would have aborted startup. They now become bridge and bridge-2 — the operator's intent is unambiguous, and failing to boot would be unhelpful.

Tests

Existing build_mcp_servers tests are migrated to the list form and extended:

• several commands produce one server each, in order
• every server receives the identity env (BUZZ_RELAY_URL, BUZZ_PRIVATE_KEY)
• colliding stems are disambiguated and names stay unique
• blank entries are skipped without dropping valid ones
• an empty list produces no servers

cargo test -p buzz-acp --lib build_mcp_servers   # 11 passed
cargo test -p buzz-acp -p buzz-agent --lib       # 603 + 292 passed

cargo fmt and cargo clippy -p buzz-acp --all-targets -- -D warnings are clean.

Notes

Independent of #3192 — different crate, no shared commits; either can merge first.

If you'd rather express this as a repeatable --mcp-server name=command flag (explicit names, no stem-collision handling needed), I'm happy to rework it — the delimited list just seemed the smaller change and consistent with --agent-args.