Add a per-run switch that disables every user MCP server, including under --acp #5336

Describe the feature or problem you'd like to solve

Starting Copilot CLI, including copilot --acp, with every user MCP server off for that process only, without listing each server name and without editing mcp-config.json. A client that starts copilot --acp as a worker needs this so a person's own MCP servers do not reach that worker.

Proposed solution

One flag, for example --disable-user-mcps, that skips every server from the user MCP config for that invocation. --disable-builtin-mcps already covers the built-ins and is the pattern to copy. State in --help that --acp honours it.

Example prompts or workflows

1. copilot --disable-user-mcps in a directory whose user config has many local servers, when this run should not start them.
2. copilot --acp --disable-user-mcps from a client that speaks ACP and wants the same empty user roster.
3. copilot --disable-mcp-server docs remains the way to drop one named server and keep the others.
4. copilot mcp disable docs remains the way to persist that one server as off across later runs.

Additional context

Measured on GitHub Copilot CLI 1.0.105 (npm latest on 2026-11-02), macOS 15.7.4 (24G517), Darwin 24.6.0 x86_64, throwaway HOME, not signed in.

copilot mcp list showed docs (local). copilot --help and copilot --acp --help list --disable-mcp-server <server-name> (one named server), --disable-builtin-mcps (built-ins only), --enable-mcp-server <server-name> and --additional-mcp-config <json>. None turns off every user server. copilot mcp enable and disable persist a per-server setting.

Not observed: whether a user server actually starts under --acp. Unsigned in, initialize succeeded and session/new returned Authentication required before any server command ran, and adding --disable-mcp-server docs produced no ACP frame within 7 seconds. Please confirm how --disable-mcp-server behaves under --acp in a signed-in session.

Nearby but different: #3380 asks to skip repo MCP files, #768 and /mcp disable persist one name, #3582 is about a "disabled": true property being ignored.