scanner: build the MCP server service bundle #1105

Summary

The same as #1104, but for MCP servers: <service-id>/specification/{config.json, <MCP artifact>}.

Motivation

MCP servers are listed as a service type in the scanner UI ("MCP Server — tool server specification"), but the product has not published push instructions for MCP yet. Only the Agent instructions exist. The bundle layout, artifact name and schema for MCP are therefore unknown, and the Agent layout must not be assumed to carry over. #1101 must confirm them; do not assume mcp-metadata.json (ledger §12.7 is the Exchange agent-network format, not necessarily this one).

Proposal

• Reuse the config.json mapper and deterministic ZIP writer from scanner: build the agent service bundle (config.json + a2a-card.json ZIP) #1104.
• Build the MCP artifact from the MCP server definition and its @donkey.tool tools, attributed per scanner: define how a @donkey.tool is attributed to an MCP server / Exchange asset #503's decision.

Cross-surface impact

• core/llm/registry/tools/integrations: registry/ (bundle). Reads core/toolspec.py (ToolSpec). tools/ not affected (discovery/binding is separate).
• TypeScript parity (planned): flagged.
• CLI: consumed by cli: donkey publish --target self-managed-scanner #1106.
• Nextra docs site: via docs: document publishing via the self-managed scanner #1109.
• docs/verified-apis.md: §13 MCP artifact row.

Out of scope

Agent bundles (#1104), MCP discovery (#221).

Depends on

• verify: self-managed scanner is GA, and its push/commit/unstage contract #1101 — MCP artifact name/schema.
• scanner: self-managed scanner client — push, commit, unstage #1103 — shared bundle types.

Related

• scanner: define how a @donkey.tool is attributed to an MCP server / Exchange asset #503 — tool→server attribution. scanner: donkey scan derives a deterministic scan model of agents, tools and MCP servers #217 — finds MCP definitions.

Acceptance criteria

• Deterministic ZIP; golden-file tests against the verify: self-managed scanner is GA, and its push/commit/unstage contract #1101 schema.
• A tool with a missing/tautological description is reported, not silently emitted.