fix: clearer Robinhood agent.json validation and safe seed config surfacing

[mvanhorn]

Summary

Improve the failure path in agent/cli/_legacy.py where No live channel configured for '<key>'. is emitted plus its follow-up hint (Add the broker's mcpServers entry to ~/.vibe-trading/agent.json first.): detect a missing or wildcard-only Robinhood entry and emit an actionable message that points at the safe read-only seed and the operator config path. Surface the canonical Robinhood seed already defined in agent/src/config/schema.py (the mcpServers seed and the existing enabledTools allowlist ('*'); pin an explicit read-only tool list guard text) through that error so the user gets a concrete copy-pasteable allowlist. In agent/src/tools/mcp.py, upgrade the existing Server '%s' produced 0 enabled tools warning so a wildcard allowlist that yields nothing names the safe allowlist remedy rather than just logging a count.

Why

The Robinhood Agentic MCP agent.json config is not created on init, and when a user supplies the common wildcard config (enabledTools: ["*"]) the CLI falls through to a vague No live channel configured for '<key>'. message instead of explaining what is wrong. The maintainer (warren618, COLLABORATOR) confirmed on 2026-06-27 that the intended Robinhood config is the explicit read-only allowlist, not enabledTools: ["*"], but the CLI should surface that clearly rather than failing opaquely. A focused PR was welcomed: clearer validation/error output, docs for the safe Robinhood seed config, and/or a helper that prints the safe config.

Closes #312

Changes

• Improve the failure path in agent/cli/_legacy.py where No live channel configured for '<key>'. is emitted plus its follow-up hint (Add the broker's mcpServers entry to ~/.vibe-trading/agent.json first.): detect a missing or wildcard-only Robinhood entry and emit an actionable message that points at the safe read-only seed and the operator config path. Surface the canonical Robinhood seed already defined in agent/src/config/schema.py (the mcpServers seed and the existing enabledTools allowlist ('*'); pin an explicit read-only tool list guard text) through that error so the user gets a concrete copy-pasteable allowlist. In agent/src/tools/mcp.py, upgrade the existing Server '%s' produced 0 enabled tools warning so a wildcard allowlist that yields nothing names the safe allowlist remedy rather than just logging a count.

Test Plan

• Existing tests pass (pytest --ignore=agent/tests/e2e_backtest --tb=short -q)
• New tests added (if applicable)
• Tested manually (describe below)
• Happy path: a valid explicit read-only Robinhood allowlist loads without warnings and yields enabled tools. - Edge case: enabledTools: ["*"] for Robinhood produces a clear, actionable validation message naming the safe read-only seed and config path, not the vague No live channel configured fallthrough. - Error path: a missing Robinhood mcpServers entry surfaces guidance pointing at ~/.vibe-trading/agent.json and the canonical seed; test asserts the message content.

Checklist

• No changes to protected areas (src/agent/, src/session/, src/providers/) without prior discussion
• No hardcoded values (API keys, file paths, magic numbers)
• Code follows CONTRIBUTING.md guidelines
• Documentation updated (if user-facing change)

AI was used for assistance.

[warren618]

Merged in e210109. Thanks @mvanhorn — this improves the Robinhood agent config path with clearer validation and safer seed-config surfacing.