feat(mcp): add GitHub, GitLab, Jira, and Confluence MCP servers

Install four MCP servers globally in the claude image:
  @modelcontextprotocol/server-github  → mcp-server-github
  @yoda.digital/gitlab-mcp-server      → gitlab-mcp-server
  @aashari/mcp-server-atlassian-jira   → mcp-atlassian-jira
  @aashari/mcp-server-atlassian-confluence → mcp-atlassian-confluence

Wire them in managed-settings.json via mcpServers with env var
pass-through. Jira and Confluence share ATLASSIAN_* credentials.
Add api.github.com, .gitlab.com, .atlassian.net to the squid
allowlist. All credentials are optional — servers are skipped
if the relevant env vars are unset.

claude/settings.json

@@ -1,10 +1,41 @@
 {
   "availableModels": ["sonnet", "opus", "haiku"],
   "permissions": {
-    "allow": [
-      "Bash(*)",
-      "Edit(*)",
-      "Write(*)"
-    ]
+    "allow": ["Bash(*)", "Edit(*)", "Write(*)"],
+    "deny": ["Bash(curl *)", "Read(.*env*)"],
+    "env": {
+      "CLAUDE_CODE_ENABLE_TELEMETRY": "0"
+    }
+  },
+  "mcpServers": {
+    "github": {
+      "command": "mcp-server-github",
+      "env": {
+        "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}"
+      }
+    },
+    "gitlab": {
+      "command": "gitlab-mcp-server",
+      "env": {
+        "GITLAB_PERSONAL_ACCESS_TOKEN": "${GITLAB_TOKEN}",
+        "GITLAB_URL": "${GITLAB_URL}"
+      }
+    },
+    "jira": {
+      "command": "mcp-atlassian-jira",
+      "env": {
+        "ATLASSIAN_SITE_NAME": "${ATLASSIAN_SITE_NAME}",
+        "ATLASSIAN_USER_EMAIL": "${ATLASSIAN_USER_EMAIL}",
+        "ATLASSIAN_API_TOKEN": "${ATLASSIAN_API_TOKEN}"
+      }
+    },
+    "confluence": {
+      "command": "mcp-atlassian-confluence",
+      "env": {
+        "ATLASSIAN_SITE_NAME": "${ATLASSIAN_SITE_NAME}",
+        "ATLASSIAN_USER_EMAIL": "${ATLASSIAN_USER_EMAIL}",
+        "ATLASSIAN_API_TOKEN": "${ATLASSIAN_API_TOKEN}"
+      }
+    }
   }
 }