[Compliance] MCP trust disclosure

Summary

We need explicit public-facing documentation of the local desktop MCP trust model and user liability boundary in the security posture narrative.

Context:

This is an intentional exception to cloud/web zero-trust.
Current technical doc exists but this should be surfaced in posture/blog materials.

References:

Add a dedicated “Local Desktop MCP Trust Boundary” section in security posture docs/blog source.
Clearly state: local process execution, no sandboxing, user responsibility for server selection.
Include a concise risk table and mitigations (vetting, env var hygiene, updates, monitoring).
Ensure messaging is consistent between product UI warnings and documentation.

Closing — this is already resolved.

The MCP trust model IS publicly documented at /apps/marketing/src/app/docs/mcp/desktop/page.tsx. The public page covers:

The claim that the trust model isn't surfaced in public-facing materials is outdated.