feat: add hosted MCP connectors and OAuth compatibility

[kapelame]

Summary

• Add verified Linear and Sentry hosted MCP connectors to the built-in directory.
• Normalize legacy provider-specific MCP OAuth credentials and capability specs to the shared mcp_oauth kind.
• Move legacy Agent-level connector bindings into the matching Agent Capability configuration so multiple hosted connectors do not overwrite each other.

Why

Earlier MCP Directory builds could leave Notion, Linear, or Sentry data using provider-specific OAuth kinds. Some databases also reached migration versions 11 or 12 on those builds, which means Goose will skip the current main branch migration 000010. Migration 000013 registers the generic kind idempotently and preserves those existing credentials and bindings.

Architecture

This reuses the existing MCP Catalog, Capability, Capability Version, Secret, and Agent Capability structures. It does not add tables, APIs, Store methods, Runtime paths, or frontend permission changes.

Validation

• make check
• make check-store
• go test ./server/internal/mcpcatalog
• ./scripts/verify-migration-order.sh origin/main
• Completed real MCP conversations using Notion, Linear, and Sentry

Scope

Miro is intentionally excluded until its OAuth and conversation flow are verified end to end.