BYO agents Phase 3: generic `mcp.mode: config` declarative MCP injection

[JAORMX]

Follow-up to #191 (epic). Phase 1 (#200) added mcp.mode: env (the agent discovers the proxy via BBOX_MCP_URL). This issue adds the second generic mode, mcp.mode: config, so a custom/BYO agent whose harness only reads a config file can be wired to the proxy declaratively — without a per-agent Go MCPInjector.

Scope

Declaratively patch a JSON/JSONC/TOML/YAML config file in the guest home:

mcp:
  enabled: true
  mode: config
  inject:
    - guest_path: .config/aider/mcp.json
      format: json
      merge:
        mcpServers:
          broodbox:
            type: streamable-http
            url: "${BBOX_MCP_URL}"

• Config shape (inject entries: guest_path, format, merge tree) stays pure domain data in pkg/domain/config / pkg/domain/agent.
• The generic merge implementation lives in internal/infra — reuse pkg/clients/internal/configio (JSON/TOML/YAML merge) and the JSONC support already in internal/infra/settings.
• ${BBOX_MCP_URL} (and other BBOX_*) substitution should resolve against the universal env from Add declarative bring-your-own agent support (#191 Phase 1) #200; config.MCPEndpointPath remains the single source of truth for the /mcp path.
• ValidateCustomAgent currently rejects mcp.mode: config with "not supported in this version" — flip that to accept + validate the inject entries (safe relative guest_path, known format).
• Built-ins keep their bespoke Plugin.MCPConfig(); this is only for data-only agents.

Acceptance criteria

A data-only agent with mcp.mode: config boots with its config file patched to point at the in-VM proxy, with no pkg/clients/ package.