Closes #103053

What Problem This Solves

Fixes a remaining issue where an owner running /mcp show in a group could expose MCP credentials stored in stdio arguments or owner/plugin-specific config fields. The earlier redaction fix covered headers, environment variables, and credentialed URLs, but argv is opaque and cannot be proven safe by field-name redaction alone.

Why This Change Was Made

Group /mcp show now resolves a private owner route before reading or rendering configuration, sends the sanitized result privately, and returns only a constant group acknowledgment. Missing or failed private delivery fails closed. Direct/DM output additionally redacts recognized credential flags and known secret-shaped argv values, while strict same-server/full-argv restoration preserves show-to-set round trips without persisting placeholders.

User Impact

Owners can inspect MCP configuration without posting it into a shared room. If no private owner route works, the group receives no server name, path, or config data and asks the owner to retry from a direct chat. Non-secret argv remains readable in private output.

Evidence

• Final rebased head ad947fc31f71: Blacksmith Testbox focused run passed 42 tests across MCP command routing, config restoration, and config-audit argv redaction.
• Blacksmith Testbox live ephemeral Gateway E2E passed the named/list display flow and CLI argv sentinel round trip; this ran on the same routing/restoration patch before the final classifier-only credential-flag expansion.
• Blacksmith Testbox pnpm check:changed passed core/test typechecks, full core lint, scripts/tooling lint, database/media/runtime guards, import-cycle checks, webhook ordering, and pairing guards on the same routing/restoration patch.
• Group regressions cover successful private delivery, missing route, delivery failure, fallback to a later owner route, constant group output, and sanitized private payloads.
• Fresh exact-head branch autoreview: no accepted/actionable findings.

Release Note Context

The centrally held release changelog already owns the credited #103396/#103053 security note, so this repair branch intentionally does not edit CHANGELOG.md.