Add a self-hosted CIMD opt-out with DCR fallback

[marcelruhf]

Summary

Executor running only on localhost can call a remote MCP/OAuth server, but that server cannot fetch Executor's Client ID Metadata Document (CIMD) from the user's loopback address; private routing, firewalls, or authenticated ingress can create similar reachability limits. Set EXECUTOR_OAUTH_CIMD_ENABLED=false to use Dynamic Client Registration (DCR), where supported, for automatic MCP and discovered OpenAPI connections; unset or true preserves CIMD, and other values fail startup.

OpenAPI templates retain their discovery metadata so unsetting the switch restores CIMD on the next connection; legacy templates recover discovery from the saved spec only when both OAuth endpoints match.

Verification

• bun run format:check
• bun run lint
• bun run typecheck
• VITEST_MAX_WORKERS=2 TURBO_TEST_CONCURRENCY=1 bun run test --env-mode=loose
• E2E — five Docker/browser scenarios passed: MCP and OpenAPI DCR → CIMD across restart, OpenAPI custom-method removal, and legacy upgrades with root and path issuers. Recordings are embedded below; passing results and redacted provider logs include inspection guidance.

Flows completed real consent, token exchange, and authenticated API calls. Provider ledgers confirmed DCR versus CIMD; mismatched legacy endpoints were rejected. Runs used local service emulators with an unpublished MCP CIMD patch. Test containers and tunnels were cleaned up. Focused checks and MCP/OpenAPI Docker flows reran after the final test simplification.

Recordings — five passing Docker scenarios

Checklist

• Added a changeset for executor (patch), following the fixed release group convention.
• Added or updated tests for the new behaviour.
• No secrets, credentials, or private data in the diff.