fix(mcp): keep global TLS opt-out from disabling MCP verification

[rodboev]

Summary

Global requestOptions.verifySsl: false was flowing into remote MCP server configs even when the MCP server block did not opt out of TLS verification. That made core/context/mcp/MCPConnection.ts build HttpsAgent({ rejectUnauthorized: false }) for SSE and streamable HTTP transports based on a global provider setting.

This change scopes MCP request-option inheritance more narrowly. Remote MCP servers still inherit unrelated global request options such as headers and proxy settings, but verifySsl only applies when it is set explicitly on that MCP server.

Addresses the TLS verification part of #11468.

Changes

• Add an MCP-specific request-options merge helper in core/config/yaml/yamlToContinueConfig.ts that strips verifySsl from global request options before merging.
• Use the same MCP merge policy in core/config/load.ts for experimental.modelContextProtocolServers non-stdio transports.
• Extend core/config/yaml/loadYaml.vitest.ts with regression coverage for global verifySsl: false on SSE and streamable HTTP, explicit per-server verifySsl: false, explicit per-server verifySsl: true, empty-options behavior, and preservation of unrelated global request options.

What This Doesn't Change

• Model and provider requestOptions inheritance is unchanged.
• Explicit per-server MCP requestOptions.verifySsl: false remains the escape hatch for insecure TLS.
• Other global request options, including headers, proxy, timeouts, CA bundles, and client certificates, still inherit into MCP server configs.
• OAuth-related behavior from [Security] TLS verification disabled in MCPConnection + auth bypass in MCPOauth #11468 is intentionally out of scope here.

Test Plan

• cd core && npx vitest run config/yaml/loadYaml.vitest.ts
  10/10 passing. Covers the MCP config conversion path, including the base-regression case where global verifySsl: false used to propagate into remote MCP request options, plus explicit per-server verifySsl overrides, empty-options behavior, and inheritance of unrelated global request options.

---

Summary by cubic

Prevented global requestOptions.verifySsl: false from disabling TLS checks for remote MCP servers. Only server-level MCP verifySsl now opts out; headers, proxy, timeouts, and cert options still inherit from global settings.

• Bug Fixes
  • Added mergeMcpRequestOptions to strip global verifySsl before merging into MCP configs.
  • Applied this policy in YAML conversion and non-stdio MCP loading to keep TLS verification on by default.
  • Added regression tests for SSE and streamable HTTP, explicit per-server verifySsl true/false, empty options, and inheritance of unrelated options.

^{Written for commit a37a046. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}