merge: AgentProject membership — the junction is now load-bearing

Merges feat/agent-project-membership (task 166/152). An agent can finally join
many projects: membership routes, per-membership role and optional brain
override, chat resolving context from the membership, and CLI attach-agent /
detach-agent / get memberships. The legacy Agent.projectId fallback is kept for
this release as the schema comment promises.

Conflict resolved in main.ts: that branch added its RBAC case to
mapUrlToPermission inline, while this branch had extracted the function to
middleware/url-permission.ts so it could be tested. Kept the extraction and
ported the case into it — joining a team is `edit:agents:<name>`, not
`create:agents`, which is the authority to mint a whole agent.

Also fixes something the extraction makes possible. security.test.ts contained a
hand-copied reproduction of mapUrlToPermission, because main.ts self-invokes
main() and nothing in it was importable. A security test asserting against a
copy stops testing the system the moment the real one changes, and this copy had
already drifted. It now imports the real function; all 18 assertions still pass,
against the code that actually runs.

Local: build clean, workspace 2550 passed, lint unchanged at 794 errors.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N4wNHWf7xSwnZCWpJcyv9p

.taskmaster/tasks/task_080.md

@@ -0,0 +1,90 @@
+# Task ID: 80
+
+**Title:** Implement Pipeline Executor
+
+**Status:** done
+
+**Dependencies:** 71 ✓, 72 ✓, 73 ✓, 79 ✓
+
+**Priority:** high
+
+**Description:** Create the pipeline executor that runs content through a sequence of stages, managing context, caching, and error handling.
+
+**Details:**
+
+Create `src/mcplocal/src/proxymodel/executor.ts`:
+
+```typescript
+import type { StageContext, StageResult, Section } from './types';
+import type { ProxyModelDefinition } from './schema';
+import { getStage } from './stage-registry';
+import { createLLMAdapter } from './llm-adapter';
+import { InMemoryCacheProvider } from './cache-provider';
+import type { ProviderRegistry } from '../providers/registry';
+
+export interface ExecuteOptions {
+  content: string;
+  contentType: 'prompt' | 'toolResult' | 'resource';
+  sourceName: string;
+  projectName: string;
+  sessionId: string;
+  proxyModel: ProxyModelDefinition;
+  providerRegistry: ProviderRegistry;
+  cache?: InMemoryCacheProvider;
+}
+
+export async function executePipeline(opts: ExecuteOptions): Promise<StageResult> {
+  const { content, proxyModel, providerRegistry } = opts;
+  const cache = opts.cache ?? new InMemoryCacheProvider();
+  const llm = createLLMAdapter(providerRegistry, opts.projectName);
+  
+  let currentContent = content;
+  let sections: Section[] | undefined;
+  let metadata: Record<string, unknown> = {};
+  
+  for (const stageConfig of proxyModel.spec.stages) {
+    const handler = getStage(stageConfig.type);
+    if (!handler) {
+      console.warn(`Stage '${stageConfig.type}' not found, skipping`);
+      continue;
+    }
+    
+    const ctx: StageContext = {
+      contentType: opts.contentType,
+      sourceName: opts.sourceName,
+      projectName: opts.projectName,
+      sessionId: opts.sessionId,
+      originalContent: content,
+      llm,
+      cache,
+      log: createLogger(stageConfig.type),
+      config: stageConfig.config ?? {},
+    };
+    
+    try {
+      const result = await handler(currentContent, ctx);
+      currentContent = result.content;
+      if (result.sections) sections = result.sections;
+      if (result.metadata) metadata = { ...metadata, ...result.metadata };
+    } catch (err) {
+      console.error(`Stage '${stageConfig.type}' failed:`, err);
+      // Continue with previous content on error
+    }
+  }
+  
+  return { content: currentContent, sections, metadata };
+}
+
+function createLogger(stageName: string) {
+  return {
+    debug: (msg: string) => console.debug(`[${stageName}] ${msg}`),
+    info: (msg: string) => console.info(`[${stageName}] ${msg}`),
+    warn: (msg: string) => console.warn(`[${stageName}] ${msg}`),
+    error: (msg: string) => console.error(`[${stageName}] ${msg}`),
+  };
+}
+```
+
+**Test Strategy:**
+
+Unit tests: single stage executes correctly, multiple stages chain output to input, originalContent preserved across stages, missing stage logs warning and continues, stage error doesn't break pipeline, sections/metadata accumulate correctly.