feat(gns2): Phase 8 MCP Docker containers for Gitea direct integration

- docker/mcp-gitea/docker-compose.yml — MCP server container (Sqcoows/forgejo-mcp)
- .kilo/skills/mcp-gitea-connection/SKILL.md — agent migration guide (103 tools)
- src/kilocode/agent-manager/mcp-gitea-client.ts — MCP native client with fallback
- Hybrid mode: MCP primary, REST API fallback if container unavailable
- All 29 Tier 0/1 agents mass-updated with GNS-2 protocol (checkpoint read, event footer)
- Security: no bash for Gitea ops, MCP handles credentials internally

Refs: Milestone #67, Issue #107

docker/mcp-gitea/docker-compose.yml

@@ -0,0 +1,78 @@
+version: '3.8'
+
+# GNS-2: MCP Gitea Integration Container
+# Replaces bash/curl scripts with native Model Context Protocol
+# See: https://github.com/Sqcows/forgejo-mcp (Recommended: 103 tools)
+
+services:
+  mcp-gitea:
+    # Option 1: Sqcows/forgejo-mcp (Recommended - 103 tools, most comprehensive)
+    # image: ghcr.io/sqcows/forgejo-mcp:latest
+    # Alternative: Build from source
+    build:
+      context: https://github.com/Sqcows/forgejo-mcp.git#main
+      dockerfile: Dockerfile
+    container_name: mcp-gitea
+    environment:
+      # Gitea instance configuration
+      GITEA_URL: https://git.softuniq.eu
+      GITEA_TOKEN: ${GITEA_TOKEN:-}
+      # Fallback to basic auth if token not set
+      GITEA_USER: ${GITEA_USER:-}
+      GITEA_PASSWORD: ${GITEA_PASSWORD:-}
+      # MCP server configuration
+      MCP_PORT: 3001
+      MCP_TRANSPORT: sse  # Server-Sent Events for streaming
+      # Logging
+      LOG_LEVEL: info
+    ports:
+      - "3001:3001"  # MCP SSE endpoint
+    networks:
+      - gns-network
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:3001/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 40s
+    # Security: read-only filesystem, no new privileges
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    tmpfs:
+      - /tmp:noexec,nosuid,size=10m
+
+  # Optional: Health check sidecar for Gitea connectivity
+  mcp-gitea-health:
+    image: busybox:latest
+    container_name: mcp-gitea-health
+    command: >
+      sh -c "
+        while true; do
+          wget -qO- http://mcp-gitea:3001/health && echo 'MCP Gitea: OK' || echo 'MCP Gitea: FAIL';
+          sleep 30;
+        done
+      "
+    networks:
+      - gns-network
+    depends_on:
+      mcp-gitea:
+        condition: service_healthy
+    restart: unless-stopped
+
+networks:
+  gns-network:
+    driver: bridge
+    name: gns-network
+    ipam:
+      config:
+        - subnet: 172.28.0.0/16
+
+# Usage:
+# 1. docker-compose -f docker/mcp-gitea/docker-compose.yml up -d
+# 2. Verify: curl http://localhost:3001/health
+# 3. List tools: curl http://localhost:3001/tools
+# 4. Agents use MCP SSE stream instead of bash curl