Add MCP servers (Gitea, K8s, Postgres, filesystem, git) to harness agents

Wire 5 MCP servers into Claude Code agents spawned by the harness:
- Gitea MCP for repo/issue/PR management on self-hosted Gitea
- Kubernetes MCP with read-only RBAC for cluster inspection
- Postgres MCP with read-only user for database queries
- Filesystem and Git MCP scoped to task worktrees

Generates .claude/settings.json in each worktree before agent spawn.
Gracefully skips for Codex/OpenCode runtimes (no MCP support).

Also fixes node-pty build failure by using local Node.js headers
instead of downloading from unofficial-builds.nodejs.org (ECONNRESET).

apps/harness/Dockerfile

@@ -1,3 +1,6 @@
+FROM golang:1.22-alpine AS gitea-mcp-builder
+RUN go install gitea.com/gitea/gitea-mcp@latest
+
 FROM node:20-alpine AS base
 RUN corepack enable && corepack prepare pnpm@latest --activate
 
@@ -5,6 +8,9 @@ FROM base AS deps
 RUN apk add --no-cache libc6-compat python3 make gcc g++ linux-headers
 WORKDIR /app
 
+# Use local Node.js headers for node-gyp (avoids flaky unofficial-builds.nodejs.org downloads)
+ENV npm_config_nodedir=/usr/local
+
 # Copy workspace root config + relevant package.jsons for install
 COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
 COPY packages/db/package.json ./packages/db/package.json
@@ -31,6 +37,16 @@ RUN npm install -g @anthropic-ai/claude-code @openai/codex
 RUN curl -fsSL https://opencode.ai/install | sh || \
     echo "WARN: opencode install failed, skipping"
 
+# MCP servers: Gitea (Go binary from builder stage)
+COPY --from=gitea-mcp-builder /root/go/bin/gitea-mcp /usr/local/bin/gitea-mcp
+
+# MCP servers: Node.js packages (pre-installed to avoid npx cold starts)
+RUN npm install -g \
+    @modelcontextprotocol/server-postgres \
+    @modelcontextprotocol/server-filesystem \
+    @modelcontextprotocol/server-git \
+    @manusa/kubernetes-mcp-server
+
 RUN addgroup --system --gid 1001 nodejs
 RUN adduser --system --uid 1001 nextjs