feat(ql3): add bounded copilot mcp surface

test/back/ql3ClusterImageSbom.test.cjs

@@ -72,10 +72,10 @@ test('generates the independent reviewed cluster-admin image closure', () => {
   assert.deepEqual(report, {
     image: 'admin',
     root: 'pkg:npm/%40qinglong/cluster-admin-image-dependencies@3.0.0-alpha.0',
-    components: 88,
-    externalComponents: 84,
+    components: 91,
+    externalComponents: 87,
     internalComponents: 4,
-    dependencyNodes: 89,
+    dependencyNodes: 92,
     inventoryVerified: false,
   });
   assert.equal(
@@ -84,6 +84,12 @@ test('generates the independent reviewed cluster-admin image closure', () => {
     ),
     true,
   );
+  assert.equal(
+    document.components.some(
+      (component) => component.name === '@modelcontextprotocol/server',
+    ),
+    true,
+  );
   assert.equal(
     document.components.some(
       (component) => component.name === '@aws-sdk/client-s3',

test/back/ql3ClusterOciLayoutAudit.test.cjs

@@ -316,7 +316,7 @@ test('accepts the independent cluster-admin image and attestation closure', (t)
   assert.equal(report.image, 'admin');
   assert.deepEqual(
     report.platforms.map((entry) => entry.spdxApplicationPackages),
-    [88, 88],
+    [91, 91],
   );
 });
 

test/back/ql3PackageBoundaryAudit.test.cjs

@@ -340,10 +340,10 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
       rootSourceFileRoles: clusterAdmin.rootSourceFileRoles,
     },
     {
-      sourceFiles: 112,
+      sourceFiles: 116,
       rootSourceFiles: 1,
       rootSourceLines: 61,
-      nestedSourceFiles: 111,
+      nestedSourceFiles: 115,
       rootSourceFileRoles: {
         'modelInvocationMigrationCli.ts': 'binary_entry',
       },