feat: runner accepts git/npx sources, broker delegates extraction

Runner /load now accepts gitUrl, npxPackage, or sourcePath. It handles
git clone and npm install internally. Broker no longer needs shared
volume for source extraction — just tells the runner what to fetch.

CLI mesh_mcp_deploy now supports npx_package as a third source type.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/mcp/tools.ts

@@ -906,6 +906,7 @@ export const TOOLS: Tool[] = [
         file_id: { type: "string", description: "File ID of uploaded zip (from share_file)" },
         git_url: { type: "string", description: "Git repo URL" },
         git_branch: { type: "string", description: "Branch to clone (default: main)" },
+        npx_package: { type: "string", description: "npm package name to run via npx (e.g. @upstash/context7-mcp)" },
         env: { type: "object", description: "Environment variables. Use $vault:<key> for vault secrets." },
         runtime: { type: "string", enum: ["node", "python", "bun"], description: "Runtime (auto-detected if omitted)" },
         memory_mb: { type: "number", description: "Memory limit in MB (default: 256)" },