feat(core): improve mcp management (#15221)

#### PR Dependency Tree


* **PR #15221** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added MCP credential management (create/reveal, list, rotate, revoke)
with expiration and status tracking.
* Introduced read-only vs read/write access modes, with read/write
tooling enabled only when permitted.
* Added workspace MCP credential configuration UI, including token
reveal and setup generation.
  * Added MCP credential GraphQL APIs to back the UI.
* **Changes**
* Replaced legacy access-token support with MCP credentials across
authentication and realtime updates.
* **Bug Fixes**
* MCP authentication now reliably rejects revoked, rotated, expired, or
disabled-user credentials.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/frontend/apps/electron/scripts/build-layers.ts

@@ -3,9 +3,27 @@ import path from 'node:path';
 
 import * as esbuild from 'esbuild';
 
-import { config, mode, rootDir } from './common';
+import { config, electronDir, mode, rootDir } from './common';
+
+async function assertNoRuntimeWorkspaceDependencies() {
+  const packageJson = JSON.parse(
+    await fs.readFile(path.resolve(electronDir, 'package.json'), 'utf8')
+  ) as { dependencies?: Record<string, string> };
+  const workspaceDependencies = Object.entries(
+    packageJson.dependencies ?? {}
+  ).filter(([, version]) => version.startsWith('workspace:'));
+
+  if (workspaceDependencies.length) {
+    throw new Error(
+      `Electron workspace dependencies must be bundled and declared as devDependencies: ${workspaceDependencies
+        .map(([name]) => name)
+        .join(', ')}`
+    );
+  }
+}
 
 async function buildLayers() {
+  await assertNoRuntimeWorkspaceDependencies();
   const common = config();
 
   const define: Record<string, string> = {