Add MCP Production Profile Packs With Secure Defaults

[dgenio]

Description

Teams need a repeatable baseline for running MCP exposure in production.

Use case

Operators want clear profiles instead of assembling many knobs by hand.

Proposed solution

• Add profile packs: strict, balanced, and trusted-network.
• Each profile sets timeout, approval, logging, retry, and side-effect defaults.
• Provide profile diff output for audit reviews.
• Include threat notes and deployment examples.
• Add validation command for profile readiness checks.

Alternatives considered

• Keep only low-level options.
• Publish profile recommendations in docs only.
• Ship a single hardcoded profile.