Pass linked MCP servers into MicroVM guest

## Defect A session placed on a MicroVM node never receives the project's linked MCP connections, on ACP or legacy: `apps/jaahd/microvm_session.py:1135-1139` builds `AcpLaunchContext` without `mcp_connections` (it defaults to empty), and no `microvm*.py` file references `mcp_connections`. So MCP connectors silently do nothing for every MicroVM run. ## Reproduction (read-only, observed by the finish stage) grep `mcp_connections` across `apps/jaahd/microvm*.py` → no hit; `microvm_session.py:1135-1139` omits the field. ## Fix (no new surface) Thread the decision's `mcp_connections` into the guest launch context exactly as the static-node path does (`apps/jaahd/fleet_dispatch.py:1490-1494`), and into the legacy guest launch once the legacy-runtime follow-up lands. The guest bridge must reach the credential socket the guest already uses for `credential.get`, and the MCP server's host must be allowed by the VM egress allowlist (`docs/policies/microvm-nodes.md` names the module that owns it — add the connection hosts per session from the decision, never a hard-coded vendor list). If the guest cannot reach the credential socket today, stop and record that as the blocker instead of adding a new channel. ## Acceptance - A MicroVM launch with `mcp_connections` carries one `mcp_<name>` bridge entry per connection; without, none. — unit test beside the existing MicroVM launch-contract tests. - Each connection's host is added to that session's egress allowlist and no other session's. — unit test. - No token in the guest's launch files, env or logs. — redaction test. - `./dc check quick` green. ## Out of scope The VM boundary, the hypervisor, NodeLink, Antigravity/Pi, and the CP. Done means: - The acceptance tests pass and are cited in the PR body.

MicroVM launches now pass linked MCP servers to the guest (one guest bridge each, ACP + legacy) and allow each host on that VM's egress only; no token written. Quick gate green, 3 review lanes pass, PR #7932 queued. CP payload key still owed: draft 13626. Memory: none applied.