chore: retire xmcp runtime surface

[disintegrator]

Linear: AIM-10

Summary

• delete the experimental server/internal/xmcp package and remove its server registration
• retire the /x/mcp runtime, OAuth, callback, install, and well-known routes without redirects
• make /mcp/{slug} the sole hosted surface in route telemetry, security checks, OAuth state, generated API descriptions, and remote-session registration
• reject cached endpoint and remote-login state that references the retired route

Motivation

/mcp/{slug} now serves every MCP backend through mcp_endpoints, so the experimental parallel runtime is redundant. Removing it also eliminates the legacy toolset fallback exposed through its OAuth handlers and prevents new clients or cached flows from continuing on the retired surface.

---

Summary by cubic

Retires the experimental /x/mcp runtime surface for AIM-10, making /mcp/{slug} the sole hosted MCP path. The old runtime, OAuth, callback, install, and well-known routes now return 404 without redirects.

• Deletes the server/internal/xmcp package and removes its server registration.
• Updates route telemetry, security checks, OAuth state, generated API descriptions, and remote-session registration to use the canonical path.
• Rejects cached endpoint and remote-login state that references the retired route.

^{Written for commit 53e3899. Summary will update on new commits.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 53e3899

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cubic-dev-ai]

Running ultrareview automatically — This cross-cutting 62-file refactor retires the /x/mcp runtime surface and touches OAuth, consent, token, and authn-challenge flows plus cached-state validation; a missed route reference or stale-state edge case could break MCP authentication and hosted serving.. I'll post findings when complete.

[cubic-dev-ai]

Ultrareview completed in 9m 47s

All reported issues were addressed

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>