buildContext() hardcoded vibnApiUrl='http://localhost:3000' and mcpToken='',
so every agent tool call (projects_list, workspace_describe, apps_list, ...)
fetched the runner itself on a dead port and failed with 'fetch failed'.
Now /agent/execute reads mcpToken from the request body and sets
ctx.vibnApiUrl (from VIBN_API_URL), ctx.mcpToken, and ctx.projectId before
running the agent.
This commit addresses the issue where DeepSeek's raw XML markup (like <tool_calls> and <think>) was leaking into chat history, causing hallucinations in subsequent turns. It also patches a vulnerability in the git commit tool where arbitrary shell injection was possible.
Additionally, it includes UX copy and color contrast adjustments for the marketing homepage breadcrumbs.
