mcp: surface profile migration guidance under --profile (#23890)

## Why

`codex --profile <name> mcp ...` should reach the same profile-v2
migration guard as runtime commands. Otherwise legacy
`[profiles.<name>]` users see the generic command-scope rejection
instead of the existing guidance to move settings into
`$CODEX_HOME/<name>.config.toml`.

## What

- Allow `codex mcp` through the `--profile` subcommand gate.
- Pass profile loader overrides into the MCP entry point only to
validate profile-v2 migration when a profile is present.
- Keep MCP add/remove/list/get/login/logout behavior otherwise
unchanged; this does not add profile-scoped MCP server management.
- Cover the legacy profile migration error for `codex --profile work mcp
list`.

## Testing

- `cargo test -p codex-cli`

codex-rs/cli/tests/mcp_add_remove.rs

@@ -68,6 +68,28 @@ async fn add_and_remove_server_updates_global_config() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn profile_mcp_reports_legacy_profile_migration() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    std::fs::write(
+        codex_home.path().join("config.toml"),
+        r#"[profiles.work]
+model = "gpt-5"
+"#,
+    )?;
+
+    let mut list_cmd = codex_command(codex_home.path())?;
+    list_cmd
+        .args(["--profile", "work", "mcp", "list"])
+        .assert()
+        .failure()
+        .stderr(contains("--profile `work` cannot be used"))
+        .stderr(contains("[profiles.work]"))
+        .stderr(contains("work.config.toml"));
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn add_with_env_preserves_key_order_and_values() -> Result<()> {
     let codex_home = TempDir::new()?;