MCP secret scrubbing — env var placeholders not resolved by opencode

[Laelia-Succubus]

Description

When opencode-synced scrubs MCP secrets and replaces them with {env:VAR_NAME} placeholders in opencode-synced.overrides.jsonc, opencode doesn't resolve these environment variables at runtime. This causes MCP servers to fail with authentication errors.

Steps to Reproduce

1. Configure github-mcp-server with a PAT in opencode.json
2. Enable opencode-synced plugin
3. The plugin scrubs the secret and creates override with process.env.GITHUB_PAT
4. MCP server stops working

Expected Behavior

Environment variables should be resolved at runtime.

Actual Behavior

Placeholder is passed as literal or empty string, causing auth failures.

Workaround

Hardcoding the PAT in overrides works but defeats the security purpose.