feat(llm-assistants): replace glab MCP with @zereight/mcp-gitlab, bump MCP server versions

[hakula139]

Summary

• Replace glab mcp serve with @zereight/mcp-gitlab (v2.0.34) as the GitLab MCP server, fixing multiple issues with the old server: CWD git remote coupling (couldn't do cross-repo operations), response body swallowing (glab api returned only pagination metadata), zero per-field schema descriptions, and 172+ tools with bare types consuming ~25k context tokens
• Add Nix package (packages/mcp/mcp-server-gitlab) using buildNpmPackage for air-gapped / devvm environments — the binary and all node_modules are pre-built in the Nix store, no npx or npm registry needed at runtime
• Add flake overlay entry (pkgs.mcp-server-gitlab) following the same pattern as mcp-server-github and mcp-server-filesystem
• Self-configuring auth: the wrapper script reads the PAT from glab config get token --host <host> (using glab CLI's own config), falling back to an agenix secret file for hosts without glab CLI (devvm, NixOS servers)
• Toolset filtering via GITLAB_TOOLSETS env var: only 7 toolsets enabled (branches, issues, labels, merge_requests, pipelines, projects, repositories), excluding wiki, milestones, releases, and users to reduce context overhead
• Update Claude Code permissions for new tool name patterns (11 old mcp__GitLab__glab_* → 29 new mcp__GitLab__* covering all write operations)
• Update instructions with usage guidance: flat descriptive parameter schemas, project_id as URL-encoded path
• Bump mcp-server-github v0.29.0 → v0.32.0, fixing the numeric type coercion issue (#2044 / #2130) where Claude sends "60" (string) instead of 60 (number) for pullNumber and similar fields
• Bump mcp-server-filesystem 2026.1.14 → 2026.1.26 (minor monorepo update)
• mcp-server-git remains at 2026.1.14 (already latest on PyPI)

Architecture

• Why replace GitLab MCP: glab mcp serve wraps the glab CLI, which was designed for interactive terminal use and assumes CWD context. @zereight/mcp-gitlab calls the GitLab REST API directly, so it has no CWD dependency and returns clean structured responses. The old server had transport-level bugs (response body swallowing) that no amount of prompting could fix.
• Why @zereight/mcp-gitlab: 1,023+ GitHub stars, most maintained GitLab MCP server. Key differentiators vs alternatives: toolset filtering (GITLAB_TOOLSETS), proxy support (HTTP_PROXY / HTTPS_PROXY / NO_PROXY), tool deny regex, read-only mode, and rich per-field schema descriptions. Evaluated against yoda-digital/mcp-gitlab-server (42 stars, no filtering), greenfinity/gitlab-mcp (lightweight but fewer features), and ttpears/gitlab-mcp (2 stars, different auth model).
• Auth cascade: glab config get host → glab config get token --host $host → agenix secret file. This is self-configuring — no need to thread a gitlabHost parameter through all 3 consumer modules (claude-code, codex, cursor). Mirrors the GitHub MCP wrapper pattern (gh auth token → agenix fallback).
• Nix packaging: buildNpmPackage with fetchFromGitHub + npmDepsHash. The postInstall creates a makeBinaryWrapper pointing node at the built build/index.js entry point, identical to the mcp-server-filesystem pattern.
• GitHub MCP v0.32.0: Adds server-side coercion for numeric string parameters. The model still sends strings, but the server now gracefully converts "60" → 60 before schema validation. Also includes context optimizations for get_files, list_pull_requests, list_issues, and other endpoints.

Test plan

• nix fmt passes on all modified Nix files
• statix check passes (no anti-patterns)
• deadnix --fail passes (no unused bindings)
• Pre-commit hooks all pass
• All 3 updated Nix packages build successfully (mcp-server-gitlab, mcp-server-github, mcp-server-filesystem)
• mcp-server-gitlab binary starts and connects to GitLab instance
• Live test: get_merge_request returns full description and metadata (previously failed with both glab mr view and glab api)
• nix flake check passes (CI)
• nix build '.#homeConfigurations.hakula-linux.activationPackage' succeeds (CI)
• nix build '.#darwinConfigurations.hakula-macbook.system' succeeds (CI)