mcp: live-refresh global connector access without restart; add MCP list to kid agent

A user's session sees global MCP connectors through UserMcpView, filtered by
accessible_global — a snapshot of mcp_global_access taken when the user's
UserContext is built at login. That context is cached until restart, so an admin
enabling/deleting a global connector or changing its access set was invisible in
MCP_LIST (and in the tool surface) until the whole process restarted.

Make accessible_global a swappable cell (SharedGlobalAccess, the MCP twin of
SharedFs for §6 fs remount): UserContext::refresh_global_access re-reads the
registry and stores it in place, and Skald::refresh_global_mcp_access broadcasts
that to every live context. Wire it into global_enable, global_delete,
global_set_access and user_connectors_set so a grant/enable is reflected in
running sessions immediately.

Also add the shared common/mcp.md include (the <!-- MCP_LIST --> sentinel) to the
kid agent, aligning it with the other agents.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/skald-core/src/skald/accessors.rs

@@ -118,6 +118,21 @@ impl Skald {
         }
         Ok(())
     }
+
+    /// Refresh every live user's global-connector access set in place — call after an
+    /// admin enables/deletes a global connector or changes who may use it, so running
+    /// sessions see it without a restart (the §7 MCP twin of the §6 fs remount). The
+    /// global runtime itself is already updated by the caller (`start_server` /
+    /// `stop_server`); this only re-snapshots each user's access filter. Best-effort:
+    /// a locked (not-live) user has no snapshot to refresh — their next login rebuilds
+    /// it from the now-current tables.
+    pub async fn refresh_global_mcp_access(&self) {
+        for ctx in self.rt_user_contexts().all_live().await {
+            if let Err(e) = ctx.refresh_global_access().await {
+                tracing::warn!(user = %ctx.user_id, error = %e, "failed to refresh global MCP access");
+            }
+        }
+    }
     pub fn sessions(&self) -> &Arc<crate::auth::SessionStore> { &self.rt.sessions }
     pub fn config(&self) -> &Arc<GlobalConfigManager> { &self.rt.config }
     pub fn config_properties(&self) -> &[core_api::ConfigSet] { &self.rt.config_properties }