feat(mcp): add uninstall + --check + README section for MCP pipeline

Three coupled additions close the MCP pipeline thread.

mcp/install.py grew --uninstall and --check modes via argparse. The
default install behavior is unchanged.

--uninstall iterates over servers.json and runs `claude mcp remove
<name> -s user` for each, skipping anything not registered. Idempotent.

--check is the dry-run drift report. For each server, classify as ok
(in both servers.json and `claude mcp list`), MISSING (configured but
not registered), or EXTRA (registered but not in servers.json). Exit
non-zero only on MISSING since EXTRA entries are often deliberate (the
claude.ai web servers register out-of-band). Smoke test against the
live config: 9 ok, 0 missing, 3 EXTRA, exit 0.

Two new Makefile targets:
- make uninstall-mcp invokes the --uninstall mode.
- make check-mcp invokes the --check mode.

README.org gained an MCP section under Two install modes covering all
three targets, the OAuth-token-on-disk story, and a pointer to
mcp/README.org for the full pipeline.

Closes TODO #7 (uninstall + --check) and TODO #8 (README MCP section).

1 files changed, 6 insertions, 0 deletions

diff --git a/Makefile b/Makefile
index 2b2cb2d..abf28c1 100644
--- a/Makefile
+++ b/Makefile
@@ -412,6 +412,12 @@ install-team: ## Install a team publishing overlay into one project ([TEAM=<team
 install-mcp: ## Decrypt mcp/secrets.env.gpg and register MCP servers at user scope (idempotent)
 	@python3 mcp/install.py
 
+uninstall-mcp: ## Remove every server listed in mcp/servers.json from `claude mcp list` (idempotent)
+	@python3 mcp/install.py --uninstall
+
+check-mcp: ## Dry-run drift report of mcp/servers.json vs registered MCP servers
+	@python3 mcp/install.py --check
+
 ##@ Compare & validate
 
 diff: ## Show drift between installed ruleset and repo source ([LANG=<lang>] [PROJECT=<path>])