remove stale uc securable mcp entries

[asujithan]

Drop stale system.ai.* MCP entries when UC discovery is disabled

Summary

Follow-up to #151. When uc_enabled flips true → false on a workspace (typically by re-running plain ucode configure after a previous ucode configure --enable-uc), any system.ai.* UC MCP service entries that were configured under the previous run linger in ~/.ucode/state.json and in each agent CLI's MCP config. They keep pointing at /ai-gateway/mcp-services/<name> and look like normal MCPs to the user even though UC discovery is now off.

This change adds a one-shot purge that runs as part of configure_shared_state whenever the previous workspace state had uc_enabled=true and the resolved value for this run is false:

• purge_uc_mcp_residue(state) (in src/ucode/mcp.py) drops every entry whose URL contains /ai-gateway/mcp-services/ from state["mcp_servers"] and de-registers it from each installed MCP client.
• configure_shared_state reads the target workspace's persisted uc_enabled once, then calls purge_uc_mcp_residue on the true → false transition only. Cross-workspace residue is still handled by the existing purge_cross_workspace_mcp_residue path.

Non-UC MCP entries (workspace HTTP connections, Genie, Databricks SQL, etc.) are untouched.

Test plan

• New unit tests in tests/test_mcp.py cover purge_uc_mcp_residue: drops only system.ai.* entries, leaves non-UC MCPs alone, no-ops when there's nothing to drop, removes per-client registrations, and warns once per purge.
• New e2e coverage in tests/test_e2e_uc.py exercises the --enable-uc → plain ucode configure flow against a real workspace and asserts the system.ai.* entries disappear from state and from every agent's MCP config.
• uv run ruff check .
• uv run pytest
• UCODE_TEST_WORKSPACE=<ws> uv run pytest tests/test_e2e_uc.py -v