MCP via pi's built-in support: mcp-loader retired upstream; skill floor, docs, sanity check

pi-extensions 750b2a8 retired mcp-loader.ts in favour of builtin:mcp (an
extension registering /mcp replaced the built-in and printed a warning on
every start). This repo has no pin to move, since PI_EXTENSIONS_REF and
MEMPALACE_TOOLKIT_REF float on main, so this commit carries what the next
build changes:

- CHANGELOG Unreleased: component table (pi-extensions a88fa99 -> 750b2a8,
  mempalace-toolkit 975ab92 -> a30af61), the switch and its measurements, the
  stale-link pruning, the new sanity check, and the floor refresh.
  check-doc-drift.sh rc=0. A two-sided check: with 750b2a8 blanked out of the
  CHANGELOG it fails rc=1, naming pi-extensions a88fa99 -> 750b2a8.
- rootfs pi-extensions skill floor refreshed to 750b2a8. check-skill-floor.sh
  was rc=1 before and is rc=0 after. Base hash changes, so the next tag
  rebuilds the base.
- recreate-sanity-check.sh: "no dangling extension links" (WARN). The
  existing count includes dangling links because ls lists them. Tested
  two-sided in a temp HOME (PASS clean; WARN naming mcp-loader.ts and x.ts.off).
  On tor-ms22 v1.11.0: rc=0, 36 pass / 3 warn / 0 fail (was 35/3/0).
- DOCKER_HUB.md: pi-extensions list was three releases stale; it now lists the
  10 that ship, plus an MCP line. Dockerfile.variant comment updated.
- lint-shell.sh: 19 files clean at severity error.

DOCKER_HUB.md

@@ -49,7 +49,8 @@ Full setup guide — authentication for each provider (Anthropic, OpenAI, Gemini
 - **pi `{{PI_VERSION}}`** ([`@earendil-works/pi-coding-agent`](https://www.npmjs.com/package/@earendil-works/pi-coding-agent)) — installed at `/usr/bin/pi`, pinned to an audited version (not npm `latest`)
 - **pi-atelier** — TUI sidebar (ordered panels, split-pane, themes), vendored at `/opt/pi-atelier` and pinned to an audited tag; the exact tag is in the image labels (`se.jordbo.pi-devbox.pi-atelier-version`) and `/etc/pi-devbox/build-manifest.json`
 - **[pi-toolkit](https://gitea.jordbo.se/joakimp/pi-toolkit)** — keybindings (mosh/tmux-friendly Shift+Enter, Ctrl+J, Alt+J newline bindings), AWS env loader, settings template
-- **[pi-extensions](https://gitea.jordbo.se/joakimp/pi-extensions)** — 7 user-facing extensions: `ext-toggle`, `mcp-loader`, `todo`, `ssh-controlmaster`, `notify`, `git-checkpoint`, `confirm-destructive`
+- **[pi-extensions](https://gitea.jordbo.se/joakimp/pi-extensions)** — 10 user-facing extensions: `ext-toggle`, `todo`, `task`, `fork-gate`, `secret-guard`, `aws-sso`, `ssh-controlmaster`, `notify`, `git-checkpoint`, `confirm-destructive`
+- **MCP servers** — pi's built-in MCP support: declare servers in `~/.pi/agent/mcp.json` (or `pi mcp add`), manage them with `/mcp`
 - **`fork`** ([pi-fork](https://github.com/elpapi42/pi-fork)) and **`recall`** ([pi-observational-memory](https://github.com/elpapi42/pi-observational-memory)) tools
 - **mempalace bridge** — MCP extension auto-symlinked so pi reads/writes the host-mounted palace
 - **image-baked agent skills** — skills under `/usr/local/share/pi-devbox/skills/` (e.g. `pi-devbox-environment`, which teaches agents the container's persistence/networking/DNS/tmux/REPL specifics) are symlinked into `~/.agents/skills/` on start, available with or without a mounted skillset repo