ASH-48: add shared project context Codex plugin

[Asherggg]

Summary

• integrate the prerequisite project-context HTTP API from ASH-45 / ASH-46: add project context data and HTTP API #17 onto current main, because ASH-45 / ASH-46: add project context data and HTTP API #17 is now conflicting
• add an official SDK-based stdio MCP server with exactly seven strict shared-context tools and companion-only HTTP access
• package the MCP server and both taskboard Skills as an official Codex plugin with a repository marketplace and validator
• document local installation, two-device cloud collaboration, security boundaries, troubleshooting, and the separate optional CDP UI integration
• harden loopback/origin handling, safe error output, canonical project mapping, timeouts, cancellation, and cloud credential forwarding

MCP Contract

The plugin exposes:

• taskboard_context_current_project
• taskboard_context_brief
• taskboard_context_search
• taskboard_context_get
• taskboard_context_publish
• taskboard_context_update
• taskboard_context_archive

Every tool has a closed input/output schema and returns structured content plus concise text. Writes preserve HTTP idempotency/version semantics. The MCP process never imports database code or reads cloud credentials; all operations go through the loopback companion.

Security And Operations

• model-visible output excludes Authorization, shared passwords, device paths, environment data, upstream messages, and unknown error codes
• companion calls reject origin-confusing paths and redirects and enforce a 10-second total deadline
• cloud forwarding pins requests and Basic Auth to the configured origin, applies a 30-second total deadline, and aborts when the local client disconnects
• cloud mode remains no-fallback and no-double-write
• ASH-48 itself adds no schema beyond the additive context migration already owned by ASH-45 / ASH-46: add project context data and HTTP API #17; destructive rollback is intentionally avoided
• full Codex session sharing remains out of scope

Verification

• npm run check: typecheck passed, production build passed, 446 tests passed, 0 failed
• npm run plugin:validate: repository plugin, plugin manifest, and both Skill validators passed
• focused local/Worker/MCP/cloud regression run: 65 tests passed, 0 failed

No production deployment or personal Codex configuration was changed.