manage shared Codex defaults

docs/plans/workflow-system.md

@@ -37,6 +37,9 @@ and add no abstraction without a demonstrated repeated need.
 - Decide whether the one-time legacy dashboard BSON migration is still needed.
 - Confirm whether the authoritative dashboard copy's `.env` and `.data` should
   supersede the divergent private state in the sync copy.
+- Rotate the exposed Context7 key and provide `CONTEXT7_API_KEY` through a
+  mode-0600 machine-local environment file on each workstation before removing
+  the static user-config header.
 - Relocate the mode-0644 `/home/kiri/work/SECRETS` file to an approved private
   owner and restrict it; its contents have not been inspected.
 - Destructive cleanup, credentials, activation, and empirical pilot decisions
@@ -57,4 +60,7 @@ and add no abstraction without a demonstrated repeated need.
   flake. Its exports, `.env`, and MongoDB state remain untouched and private.
 - The obsolete `feat/echarts-domain` worktree path is absent; its branch remains
   and its prunable metadata has not been removed.
+- Shared Codex defaults and MCP endpoints are generated at
+  `/etc/codex/config.toml`; Context7 reads its header from the environment. The
+  unused generic `~/.config/mcp/mcp.json` owner is removed on next activation.
 - Run independent pilots in parallel, but gate every retirement separately.