Initial segregate: proxy source, deploy manifests, ImagePolicy Flux CRs.

Move workload out of infra with cursor-devbox-style GitRepository +
run_number-sha image automation.

scripts/mcp-stdio-bridge.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+# Bridge: cursor-agent spawns this as a stdio MCP server. We connect to a
+# per-session unix socket provided as $1 and tunnel newline-delimited
+# JSON-RPC frames between cursor-agent's stdin/stdout and the proxy-owned
+# socket server (which is the real MCP server).
+#
+# Uses Node (always available in the image) rather than nc, to avoid
+# depending on netcat variants that may not support -U for unix sockets.
+socket="$1"
+if [ -z "$socket" ]; then
+  echo "usage: $0 <socket-path>" >&2
+  exit 1
+fi
+
+exec node -e '
+const sock = process.argv[1];
+if (!sock) { console.error("mcp-stdio-bridge: missing socket arg"); process.exit(1); }
+const net = require("node:net");
+const conn = net.createConnection(sock);
+let buf = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => {
+  // Forward as-is; JSON-RPC frames are newline-delimited on both sides.
+  conn.write(chunk);
+});
+process.stdin.on("end", () => conn.end());
+conn.setEncoding("utf8");
+conn.on("data", (chunk) => process.stdout.write(chunk));
+conn.on("end", () => process.exit(0));
+conn.on("close", () => process.exit(0));
+conn.on("error", (e) => {
+  console.error("[mcp-stdio-bridge] socket error: " + e.message);
+  process.exit(1);
+});
+process.on("SIGPIPE", () => process.exit(0));
+' "$socket"