claude_code preset auto-attaches the user's claude.ai-connected partner
MCPs (mcp__claude_ai_*). They bypass MCPActivate, don't share OAuth
state with OpenSwarm's Gmail/Drive/Calendar connectors, and confuse
the model into picking the partner shim instead of our vetted server.
Hard-block via disallowed_tools + add a system-prompt rule.