fix(core): avoid nested MCP code mode - #45377

Issue for this PR

No linked issue.

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Prefer individual remote MCP tools behind OpenCode's Code Mode instead of nesting server-side code execution.

• Default remote transport URLs to codemode=false, which Cloudflare's API MCP supports. Preserve explicit query values and skip servers configured for direct tools.
• Keep configured URLs unchanged so existing MCP OAuth credential identities remain stable.
• Remove the Cloudflare exclusion so its expanded tool list stays behind OpenCode's bounded catalog.

The query parameter is a best-effort server convention, not an MCP standard. Cloudflare MCP Portals uses codemode=off; explicitly configured values remain untouched.

How did you verify your code works?

• 60 tests passed across MCP transport, OAuth, exclusions, and Code Mode catalog tests, including new real-HTTP query checks.
• bun typecheck passed in packages/core.
• Prettier and git diff --check passed. Oxlint reported no errors and three existing test-file warnings.
• Confirmed the flag against upstream documentation and source. No live authenticated Cloudflare session was exercised.

Screenshots / recordings

Not applicable.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR