feat(mcp): pull workspace root Folders when no project is selected

[Yevhenii-Matvienko]

Adds a root-Folders pull path to corezoid-init: declining the project picker now offers to pull everything under the workspace's root Folders (folders, processes, state diagrams, aliases) in one call, without needing a stage or project. pull-folder/list-folders/ show-folder/pull-process work before a stage is configured.

Also fixes list-folders reading the wrong field for entry kind, pulling a plain folder failing with "stage directory not found", and .env writes getting silently dropped when more than one MCP server process is alive at once.

[gh-corezoid]

AI Review

Adds root-Folders pull path (folder_id=0) to corezoid-init, fixes list-folders obj_type field, plain-folder unzip suffix, concurrent .env write race, and stale auth state across multi-process MCP servers. All checks pass; one style warning on importing testing in production code.

Checklist

Check	Result
U1 Conventional commit format	✅ pass — feat(mcp): pull workspace root Folders when no project is selected (66 chars, valid type/scope, lowercase, no trailing period)
U2 No leaked credentials	✅ pass — no ghp_, Bearer tokens, or private IPs found in diff
U3 No merge commits	✅ pass — single commit, one parent
U4 PR targets correct base branch	✅ pass — targets main
U5 Build & test (Go)	✅ pass — go build ./... succeeds; go test ./... has one pre-existing failure (TestSkillPathsExist) present identically on main; no regressions introduced
C1 All four manifest files version-synced	✅ pass — all four manifests bumped to 2.8.0: .agents/plugins/marketplace.json, .claude-plugin/marketplace.json, plugins/corezoid/.claude-plugin/plugin.json, plugins/corezoid/.codex-plugin/plugin.json
C2 Node IDs in .conv.json are valid UUIDs	⏭️ skip — no .conv.json files in diff
C3 No hardcoded env values in .conv.json	⏭️ skip — no .conv.json files in diff
C4 extra fields have matching extra_type	⏭️ skip — no extra-field changes in diff
C5 README updated for new skills	⏭️ skip — no new skill directories added (corezoid-init/SKILL.md was modified, not created)

Issues found

warning — plugins/corezoid/mcp-server/main.go imports the testing package in non-test production code to call testing.Testing() inside refreshAuthStateFromEnv(). While this compiles cleanly under Go 1.24 (go build ./... and go vet ./... both pass) and testing.Testing() is a supported Go 1.21+ API, importing testing in a main package source file (not a _test.go file) is unconventional and may raise eyebrows in code reviews or static-analysis tools. Consider an alternative: expose a package-level var skipEnvRefresh bool set by tests via TestMain, or use a build tag, to avoid the testing import in the production binary.

---

This review was generated automatically. A human maintainer makes the final decision.