feat(mcp): add custom agent profiles

[mkdev5]

Summary

• Closes feat(distribution): add Gittensory custom agent profiles #276.
• Add optional init-client --agent-profile output for the three requested coding-agent profiles: miner planner, maintainer queue triage, and repo-owner intake.
• Keep profiles print-only and human-approved: they guide MCP prompt/tool usage but do not edit client files, request credentials, upload source contents, or perform GitHub writes.
• Document the profile setup and boundaries in the MCP package README.

Scope Summary

This PR only changes the MCP CLI package behavior, MCP package README, and focused CLI tests. It does not add package files, dependencies, app UI routes, generated artifacts, backend/API behavior, or changelog entries.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:version-audit
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• None. npm run test:ci passed locally. Focused checks also passed: npm run test -- test/unit/mcp-cli.test.ts, npm run build:mcp, and npm run test:mcp-pack.
• A first sandboxed focused CLI test failed/timed out because local HTTP fixtures could not bind 127.0.0.1 (listen EPERM), and sandboxed test:mcp-pack returned empty npm pack --json; both passed when rerun outside the sandbox. The full npm run test:ci gate passed outside the sandbox.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. N/A; this PR does not change auth, cookies, CORS, GitHub App, Cloudflare, or sessions.
• API/OpenAPI/MCP behavior is updated and tested where needed. CLI output and MCP package contents are covered by focused tests and package dry-run validation.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. N/A; no app UI changed.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. MCP package README is updated; changelog is intentionally unchanged.

UI Evidence

No web UI, frontend route, browser-extension state, or overlay changed. This is MCP CLI output plus package README text, so screenshot evidence is not applicable.

State / title	JPG/PNG evidence
Not applicable	No visible app UI change

Notes

• The new flag is --agent-profile so it does not conflict with the existing auth/session --profile flag.
• JSON output includes profile metadata for agent runtimes; plain output prints the client config followed by profile instructions.
• The package dry-run still contains only the expected package files: README, changelog, license, MCP CLI, local-branch helper, and scorer scripts.

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#473 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[mkdev5]

@JSONbored please review the PR

[JSONbored]

@MkDev11 this is ready from my side.

A few notes:

• The --agent-profile flag is focused, avoids colliding with the existing auth/session --profile, and keeps the generated instructions human-approved.
• The README guidance is clear about boundaries and avoids turning these profiles into autonomous GitHub actors.
• The CLI tests cover JSON/plain output and unsupported profile handling.

No code changes requested.