Extract mcp-server to its own repo (meshtastic/meshtastic-mcp) (#10861)

The Python MCP server + hardware test harness that lived under mcp-server/
now has its own home at https://github.com/meshtastic/meshtastic-mcp
(published, versioned independently). Remove the in-tree copy and wire the
firmware repo to the standalone server externally.

- Delete mcp-server/ (96 files) and the 8 harness-coupled AI workflow files
  under .claude/commands/ and .github/prompts/ that drove ./mcp-server/
  run-tests.sh — those workflows now ship with meshtastic-mcp as skills.
- .mcp.json: register the server via
  `uvx --from git+https://github.com/meshtastic/meshtastic-mcp meshtastic-mcp`
  instead of a local ./mcp-server/.venv, keeping MESHTASTIC_FIRMWARE_ROOT="."
  so the MCP tools still work from this checkout with no local build.
- Repoint the remaining references (AGENTS.md, CLAUDE.md,
  .github/copilot-instructions.md, bin/regen-*.sh, docs, Screen.h,
  userPrefs.jsonc, test/fixtures/nodedb/README.md, .trunk/configs/.bandit)
  at the standalone repo. The MCP tool surface is unchanged — only the
  pytest harness moves out; run it from a meshtastic-mcp checkout with
  MESHTASTIC_FIRMWARE_ROOT pointed here.

No build/CI/platformio coupling existed, so nothing in the firmware build
changes.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

.trunk/configs/.bandit

@@ -12,10 +12,10 @@
 #   defensive loops over flaky sources (pubsub handlers, device
 #   re-enumeration polls). One failed iteration shouldn't abort the loop.
 # B404 import_subprocess
-#   mcp-server wraps PlatformIO, esptool, nrfutil, picotool, and the
-#   pytest test-runner — subprocess is a load-bearing import here, not
-#   a smell. The "consider possible security implications" advisory is
-#   redundant given the file-level review already applied.
+#   the bin/ proto + fixture tooling (regen-py-protos, gen-fake-nodedb-seed,
+#   seed-json-to-proto) shells out to protoc and helper scripts — subprocess
+#   is a load-bearing import here, not a smell. The "consider possible security
+#   implications" advisory is redundant given the file-level review already applied.
 # B603 subprocess_without_shell_equals_true
 #   all subprocess calls use a static argv list; `shell=False` is the
 #   default and we never string-interpolate user input into the command.