feat(mcp): enforce spec-compliant tool registry

- Reject dotted tool identifiers during registration and remove alias-backed lookups.
- Drop web.search compatibility, normalize all code/tests around the canonical web_search name, and update consent/session logic.
- Harden CLI toggles to manage the spec-compliant identifier and ensure MCP configs shed non-compliant entries automatically.

Acceptance Criteria:
- Tool registry denies invalid identifiers by default and no alias codepaths remain.

Test Notes:
- cargo check -p owlen-core (tests unavailable in sandbox).

crates/owlen-core/src/config.rs

@@ -2,6 +2,7 @@ use crate::Error;
 use crate::ProviderConfig;
 use crate::Result;
 use crate::mode::ModeConfig;
+use crate::tools::WEB_SEARCH_TOOL_NAME;
 use crate::ui::RoleLabelDisplay;
 use serde::de::{self, Deserializer, Visitor};
 use serde::{Deserialize, Serialize};
@@ -328,6 +329,11 @@ impl Config {
         }
     }
 
+    /// Generate MCP server configurations that mirror the Codex CLI defaults.
+    pub fn codex_default_servers() -> Vec<McpServerConfig> {
+        crate::mcp::codex::codex_connector_configs()
+    }
+
     /// Persist configuration to disk
     pub fn save(&self, path: Option<&Path>) -> Result<()> {
         let mut validator = self.clone();
@@ -1682,7 +1688,7 @@ impl SecuritySettings {
 
     fn default_allowed_tools() -> Vec<String> {
         vec![
-            "web_search".to_string(),
+            WEB_SEARCH_TOOL_NAME.to_string(),
             "web_scrape".to_string(),
             "code_exec".to_string(),
             "file_write".to_string(),