feat(auth): add --bare flag and MCP server sync for profiles

- Add --bare flag to `ccs auth create` to skip shared symlinks
  (commands/, skills/, agents/, settings.json). Bare profiles are
  clean instances without ClaudeKit or other global extensions.
  `ccs sync` respects bare flag and skips re-linking.

- Add MCP server sync from global ~/.claude.json to instances.
  Claude Code stores MCP config in ~/.claude.json (not settings.json),
  which was invisible to CCS profiles using CLAUDE_CONFIG_DIR isolation.
  Selective copy of mcpServers key only (not OAuth sessions/caches).
  `ccs sync` refreshes MCP servers across all non-bare instances.

Closes #691
Closes #692

src/auth/auth-commands.ts

@@ -91,6 +91,9 @@ class AuthCommands {
       `  ${color('ccs auth create backup --context-group sprint-a --deeper-continuity', 'command')}`
     );
     console.log('');
+    console.log(`  ${dim('# Create clean profile without shared commands/skills/agents')}`);
+    console.log(`  ${color('ccs auth create sandbox --bare', 'command')}`);
+    console.log('');
     console.log(`  ${dim('# Set work as default')}`);
     console.log(`  ${color('ccs auth default work', 'command')}`);
     console.log('');
@@ -116,6 +119,9 @@ class AuthCommands {
     console.log(
       `  ${color('--deeper-continuity', 'command')}       Advanced shared mode: sync additional continuity artifacts`
     );
+    console.log(
+      `  ${color('--bare', 'command')}                    Create clean profile without shared symlinks (no CK/commands/skills)`
+    );
     console.log(
       `  ${color('--yes, -y', 'command')}                 Skip confirmation prompts (remove)`
     );