Add project-local MCP fallbacks while upstream APM catches up

[srid]

Chrome DevTools MCP is now declared in the top-level apm.yml, but this branch keeps project-local fallbacks for the runtimes APM does not fully cover yet. Claude still reads the checked-in root .mcp.json, and Codex now gets a checked-in .codex/config.toml for trusted projects. That lets the repo use one MCP server definition across the current tool mix without pretending upstream support is further along than it is.

The split is explicit instead of accidental. apm.yml and apm.lock.yaml describe the chrome-devtools server for the runtimes APM wires up today, OpenCode keeps the generated root opencode.json, and agents/ai.just now documents the manual fallbacks plus the upstream TODOs: microsoft/apm#655 for Claude and microsoft/apm#803 for project-scoped Codex MCP.

apm-sync is tighter in this branch than on master. It now verifies the root-level opencode.json that APM emits for OpenCode MCP config, using semantic JSON comparison so newline trivia does not create drift. It also deliberately ignores the manual .codex/config.toml until microsoft/apm#803 lands, and ignores local OpenCode runtime noise (node_modules, package.json, package-lock.json, .gitignore) so the check stays focused on APM-managed output.

Verification on commit ee374f5abaff9b93931be0ee65e9f505dfc77feb:

• just fmt
• just ai::apm-sync
• just ci::fmt
• just ci::apm-sync

Upstream references:

• microsoft/apm#655 — Claude project/user MCP support (still unmerged)
• microsoft/apm#803 — Codex project-scoped MCP support (open)