fix(plugins): attribute all MCP configs via X-Sentry-Utm-Source

[sentry-junior]

Summary

Move all four plugin MCP configs off ?utm_source=plugin onto bare https://mcp.sentry.dev/mcp + X-Sentry-Utm-Source: plugin.

This keeps OAuth resource indicators query-free while preserving app.utm_source:plugin attribution (once the companion MCP server change is deployed).

Harness header support (verified)

Harness	Config surface	Header support	Source
Claude Code	inline plugin.json mcpServers	headers on http/sse/ws	Claude Code MCP docs (headers / headersHelper); plugin manifest schema
Cursor	root mcp.json	headers on remote HTTP/SSE	Cursor MCP docs remote server example + config interpolation lists headers
Codex	plugin .mcp.json (from mcp.json)	JSON headers mapped to transport http_headers	Codex MCP docs (http_headers / env_http_headers in config.toml); plugin JSON parser tests in openai/codex plugin_config_tests.rs accept "headers":{"X-Plugin":"demo"}; agent-plugins mcp.schema.json defines headers
Grok	root .mcp.json (from mcp.json)	headers on HTTP MCP	Grok MCP servers docs (headers = { ... } / grok mcp add --header); remote MCP tools also document headers / extra_headers

Changes

Shared config used by Cursor/Codex/Grok builds:

{
  "mcpServers": {
    "sentry": {
      "type": "http",
      "url": "https://mcp.sentry.dev/mcp",
      "headers": {
        "X-Sentry-Utm-Source": "plugin"
      }
    }
  }
}

• mcp.json + .mcp.json (kept identical)
• src/plugins/claude/plugin.json (inline, same shape)
• AGENTS.md / TELEMETRY.md updated for header-first attribution; legacy query-param noted as server fallback only

Build wiring unchanged:

• Cursor copies mcp.json → mcp.json
• Codex/Grok copy mcp.json → .mcp.json
• Claude uses inline plugin.json only

Companion

MCP server header support: getsentry/sentry-mcp#1230

Deploy order

1. Land + deploy sentry-mcp #1230
2. Land this PR (deploys to each plugin-* develop on merge; release to ship to consumers)

Checks

• Asserted all three config files match bare URL + X-Sentry-Utm-Source: plugin
• No ?utm_source=plugin remaining in plugin MCP configs
• Docs-only / static manifest change; no installer runtime tests run

Notes / risks

• Until #1230 is deployed, header-only traffic connects but won’t set app.utm_source:plugin (still gets app.client.family from UA)
• Existing installs keep old query-param URLs until plugin update
• Server still accepts legacy ?utm_source= for older configs

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 12ba9bf. Configure here.}