chore: pre-migration snapshot

Layer0, MCP servers, Terraform consolidation

SECURITY_WAF_INTEL.md

@@ -109,6 +109,8 @@ A local MCP server is registered in `opencode.jsonc` as `waf_intel`:
 }
 ```
 
+`waf_intel_mcp.py` delegates to the in-repo MCP stdio JSON-RPC implementation (`mcp.waf_intelligence.mcp_server`), so it does not require installing a separate Python MCP SDK.
+
 The `security-audit` agent has `waf_intel` enabled in its tools section:
 
 ```jsonc