fix(pi): load MCP adapter in isolated runs

[drewstone]

What changed

• explicitly load the installed pi-mcp-adapter when a scoped Pi request declares MCP servers
• expose the installed extension dependency tree read-only inside the filesystem jail
• retain local-path adapter discovery while refusing installs with no loadable path

Why

PR #114 points Pi at a fresh credential-free config directory. That also removed ambient extension discovery, so request-level MCP passed --mcp-config without loading the adapter. The filesystem jail then needed the adapter dependency tree, not only the package directory.

Proof

• regression test before fix: missing --extension
• real Pi 0.83.0 before fix: Unknown option: --mcp-config and hidden zod dependency
• real Pi 0.83.0 after fix: request MCP completed through the installed adapter under read confinement
• pnpm test: 641 passed, 7 skipped
• pnpm typecheck: passed
• git merge-tree --write-tree origin/main HEAD: dfc0e33adb04525d691ea83511f55ced96d3ac4c