agent: block claude.ai partner MCPs in prompt + at SDK layer

claude_code preset auto-attaches the user's claude.ai-connected partner
MCPs (mcp__claude_ai_*). They bypass MCPActivate, don't share OAuth
state with OpenSwarm's Gmail/Drive/Calendar connectors, and confuse
the model into picking the partner shim instead of our vetted server.
Hard-block via disallowed_tools + add a system-prompt rule.

backend/apps/agents/agent_manager.py

@@ -662,6 +662,13 @@ class AgentManager:
             "`mcp__*__authenticate` helpers — those are legacy shims; always go "
             "through MCPActivate."
         )
+        sections.append(
+            "1a. NEVER call any tool whose name begins with `mcp__claude_ai_` "
+            "(claude.ai-connected partner shims). They bypass the OpenSwarm "
+            "gate and don't share auth with this app. If the user wants Gmail/"
+            "Calendar/Drive, the equivalent OpenSwarm server is listed below; "
+            "activate that one via MCPActivate instead."
+        )
         sections.append(
             "2. After MCPActivate returns, end the turn — a follow-up turn fires "
             "automatically with the new tools available."
@@ -2375,6 +2382,17 @@ class AgentManager:
             if session.max_turns:
                 options_kwargs["max_turns"] = session.max_turns
 
+            # The claude_code preset auto-attaches the user's claude.ai-
+            # connected partner MCPs (`mcp__claude_ai_*`). Those bypass our
+            # MCPActivate gate, don't share OAuth state with the OpenSwarm
+            # Gmail/Calendar/Drive connectors the user actually configured
+            # here, and confuse the model into picking the partner shim
+            # instead of our vetted server. Hard-block them at the SDK
+            # layer so the model can't even attempt the call.
+            options_kwargs["disallowed_tools"] = [
+                "mcp__claude_ai_*",
+            ]
+
             if session.cwd:
                 # Pre-existing sessions may have workspaces that predate
                 # the git-init block in launch_agent, leaving them