fix(codexcli-mcp): tighten envVars handling

[sirmacik]

Summary

Draft follow-up for #1625. This tightens Codex MCP envVars handling and prevents rulesync-only source fields from leaking into Codex output.

Changes

• Generate Codex MCP from RulesyncMcp.getMcpServers() stripped output, then re-merge only valid codex-specific envVars from the raw source.
• Replace repeated field rename branches with shared mapping tables for enabledTools / disabledTools / envVars.
• Ignore malformed env_vars, enabled_tools, and disabled_tools arrays when importing Codex TOML.
• Validate envVars entries as environment variable names in the Rulesync MCP schema.
• Add regression tests proving Codex output keeps env_vars but strips targets, description, and exposed.
• Link docs to the Codex configuration reference with a last-checked date and sync skills/rulesync docs.

Fixes #1625.

Verification

• pnpm test src/features/mcp/codexcli-mcp.test.ts src/types/mcp.test.ts
• pnpm cicheck

Deferred

Two cross-generator follow-ups from #1625 are intentionally deferred to keep this PR focused:

• Cursor source-preservation assertion for targets.
• Parametric contract test across every non-Codex MCP generator for envVars / targets / description / exposed stripping.

Those are valuable, but they touch broader generator behavior and should stay separate from the Codex-specific cleanup.

Review notes

Opened as draft to signal ownership and keep the maintainer-scrap follow-up visible while avoiding immediate review pressure.

[github-actions]

Thank you for your contribution! Unfortunately, you currently have 5 open PRs (including this one), which exceeds the limit of 2 for external contributors.

Please wait for an existing PR to be reviewed/merged, or close one before opening a new one. See CONTRIBUTING.md for details.