fix: ship the MCP declaration in the directory bundle

[sherwinski]

One Line Summary

scripts/package_directory_bundle.py now keeps mcpServers: "./.mcp.json" in the bundle manifest and copies .mcp.json to the bundle root, so the OpenAI plugin directory accepts the zip as an update to the OneSignal listing.

Motivation

The upload of the 1.2.1 zip passed the name check and then failed with:

Keep the existing MCP connection .codex-plugin/plugin.json. This package omits the plugin's existing MCP. Restore its MCP declaration and connection before submitting or publishing. Removing the MCP isn't supported.

The packager was written for the portal's Skills-only upload path, which rejects mcpServers and .mcp.json (mcp_configuration_excluded). The OneSignal listing is not a Skills-only plugin: it has an MCP connection, and the portal treats an update that omits the declaration as a removal, which it does not support. The declaration therefore has to ship in the package.

Scope

This PR fixes the 3 portal findings that followed the name fix, in commit order: the missing MCP declaration, the Skills-only wording, and the listing rules (subtitle length, support URL).

• scripts/package_directory_bundle.py:
  • bundle_manifest sets mcpServers to ./.mcp.json instead of removing it.
  • build_bundle copies .mcp.json to the bundle root.
  • The source gate has a new check_mcp_config: .mcp.json must be a JSON object with a non-empty mcpServers.
  • The bundle gate requires mcpServers == "./.mcp.json" and the file; the 2 checks that rejected MCP configuration are gone.
  • The self-test copies .mcp.json into each test tree and has a new case, "tree without the MCP declaration".
  • The module docstring describes the bundle as a full package, not a Skills-only one.
• AGENT.md: the manifest row, the bundle section, and the gate bullet say that .mcp.json ships and why.
• .codex-plugin/plugin.json: shortDescription is "Set up push, email, and SMS" (27 characters); supportURL is the repository issues page; the long description drops "market leading" and "free" after the portal's advisory findings.
• The packager gate checks displayName and shortDescription at 30 characters and requires the 4 listing URLs as HTTPS, with a self-test case for each.
• .mcp.json itself is unchanged: onesignal -> https://api.onesignal.com/mcp/oauth.
• No changes to skills, references, or templates.
• No version bump; the release PR bumps the version.

Testing

• python3 -m py_compile scripts/*.py passed.
• python3 scripts/package_directory_bundle.py --check printed bundle check passed (version 1.2.1; nothing written).
• python3 scripts/package_directory_bundle.py --self-test passed all 17 cases, including the new one.
• python3 scripts/package_directory_bundle.py --out /tmp/bundle built a bundle with .codex-plugin/, .mcp.json, assets/, and skills/ at the root. The manifest has name app-6a3d93b924488191bdb7eb40fc4219e6, skills ./skills/, and mcpServers ./.mcp.json. The copied .mcp.json matches the repository file.
• Not tested: the portal upload. The next upload will show whether the portal accepts the declaration as the same connection. The docs say a change to an existing MCP server URL needs support, so the URL in .mcp.json must match the URL of the connection the portal already holds.

Affected code

• Skills
• Scripts
• References
• Templates
• Manifests

Checklist

• Commit subjects use conventional prefixes
• Bundle gate passes
• No secrets in the diff