Shorten the ChatGPT server instructions to cross-tool rules

[helpcodeai]

Summary

OpenAI's plugin scan of our ChatGPT submission flagged the server instructions of the ChatGPT profile on the shared /mcp ("These server instructions appear to execute operations that are not individually exposed"). Those instructions walked through every tool one by one. OpenAI's guidance for server instructions is to carry only rules that span tools, keep the important part in the first 512 characters and not repeat the tool descriptions. This PR does that for the chatgpt profile only.

Cloud and self-hosted: the change only affects connections whose OAuth client registered a chatgpt.com / openai.com redirect URI and only where /mcp serves the fixed tool set (Cloud default, opt-in on self-hosted via MCP_SHARED_ENDPOINT_TOOLS=fixed). The default set served to Claude and every other client, including its instructions, is unchanged.

Changes

• CHATGPT_INSTRUCTIONS now has three rules: read the workspace guide before first using a connector, confirm each anythingmcp_run_write_tool / anythingmcp_add_connector call, never ask for secrets in the chat (under 512 characters)
• Tool list, descriptions, schemas and annotations unchanged
• New spec: ChatGPT instructions stay within 512 characters and do not list the tools; the controller spec compares against the profile's instructions instead of a tool name

Type

• Bug fix
• New feature
• Documentation
• Refactoring
• Performance improvement
• Other (describe below)

Testing

• Added/updated unit tests
• Tested manually (describe steps below)
• No tests needed (explain why)

Run in packages/backend:

• npx jest src/mcp-server: 22 suites, 336 tests passed
• npx tsc --noEmit -p tsconfig.json: clean
• npm run lint: its --fix rewrote two unrelated files, reverted, not part of this PR

The existing spec "leaves the default set exactly as the Claude directory reviewed it" still passes unchanged.

Checklist

• My code follows the existing code style
• I have tested my changes locally
• I have updated documentation (if applicable)
• All existing tests pass (npm test)
• This PR has a descriptive title

Related Issues

None.