ungated-global: system project whose servers ride every project, pre-gate

New seed-once system project `ungated-global`: every server attached to it
is merged into every project's MCP endpoint in front of the gate (listed
and callable before begin_session), and its project prompt is prepended to
every project's instructions.

- mcpd: bootstrapUngatedGlobal seeds the project once-ever (marker key
  `ungatedGlobalSeeded` in mcpctl-system-settings), with default server
  `calcmcp` (patched CalcMCP fork, mysources.co.uk/michal/calcmcp:1.1.0)
  and a "never do math yourself, always use calcmcp" prompt. Deletions are
  durable: `mcpctl delete server calcmcp -p ungated-global` stays deleted.
- mcpd: GET /projects/:id/servers appends global servers flagged
  `ungatedGlobal: true` (direct attachment wins, no self-merge);
  GET /projects/:id/instructions prepends the global prompt and lists the
  global servers.
- mcplocal: discovery surfaces the flagged names; the gate plugin exempts
  them — gated tools/list returns begin_session + exempt tools, calls to
  them pass through without ungating, and initialize instructions list
  them under "Available immediately (no begin_session required)".
- templates/calcmcp.yaml so a deleted default can be re-created by hand.
- docs/ungated-global.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

templates/calcmcp.yaml

@@ -0,0 +1,20 @@
+name: calcmcp
+version: "1.1.0"
+description: Scientific calculator (SymPy/NumPy/SciPy) — symbolic algebra, calculus, equation & ODE solving, linear algebra, statistics, FFT
+dockerImage: "mysources.co.uk/michal/calcmcp:1.1.0"
+transport: STDIO
+repositoryUrl: https://mysources.co.uk/michal/CalcMCP
+# Patched fork of github.com/thinkitpossible/CalcMCP: proper MCP inputSchema,
+# English tool docs, eval() removed, complex eigenvalues serialize, symbolic
+# dsolve added. Pure compute — needs no env, no secrets, no egress.
+# Seeded by default into the ungated-global project (see docs/ungated-global.md);
+# this template exists so a deleted default can be re-created by hand:
+#   mcpctl create server calcmcp --from-template calcmcp
+healthCheck:
+  tool: symbolic_tool
+  arguments:
+    operation: simplify
+    expression: "1+1"
+  intervalSeconds: 300
+  timeoutSeconds: 10
+env: []