feat: add local ChatGPT and Codex stdio plugin - #703

Description

Adds a repository-distributed StackQL plugin for ChatGPT desktop and Codex CLI using the existing MCP npm packaging over stdio.

The plugin:

• launches pinned @stackql/mcp-server@0.10.582
• reuses the existing signed MCPB download and verification workflow
• uses standard provider authentication environment variables
• supports credential refresh through reload_credentials
• includes Linux, macOS, and Windows CI coverage
• includes local installation and hello-world documentation

Also fixes credential reload with no authentication contexts returning providers: null. It now returns an empty array matching the MCP output schema.

This does not alter the Anthropic submission or existing npm, MCPB, PyPI, OCI, or MCP Registry installation paths.

Public ChatGPT directory submission is not included because that requires a public production MCP endpoint and domain verification. This change covers the local stdio use case.

Type of change

• Feature
• Bug fix
• Documentation update
• Refactoring
• Other

Issues referenced.

Addresses #699

Evidence

• Full Go unit test suite passed
• Targeted MCP backend tests and vet passed
• Plugin manifest validation passed
• Linux stdio smoke test passed
• GitHub public access without authentication passed
• AWS authentication using predefined environment variables passed
• reload_credentials smoke coverage passed
• Focused Robot regression passed: 1 passed, 0 failed
• Workflow actionlint passed
• Diff-scoped golangci-lint passed with 0 issues

Checklist

• A full round of tests have been performed and there are no test failures as a result of these changes
• Functional Robot coverage has been added
• Changes have been tested on all supported platforms
• Unit tests pass locally
• Robot tests pass locally
• Linter passes locally

Variations

The new focused Robot regression passes.

The full functional Robot run completed with 461 passed and 66 failures caused by the existing local environment:

• missing build/stackql_mcp_client
• PostgreSQL key permission rejection from WSL-mounted NTFS

The new regression passed within that full run.

Full repository lint reports 20 pre-existing revive findings in untouched files. Diff-scoped lint reports 0 issues.

The added CI matrix will verify Linux, macOS, and Windows on the PR.

Tech Debt

No technical debt introduced.

Public universal directory deployment and submission should be tracked separately because it requires a hosted MCP endpoint and domain verification.