fix: restore provider and config compatibility checks

src/secrets/runtime-config-collectors-plugins.ts

@@ -9,7 +9,7 @@ import {
 import { isRecord } from "./shared.js";
 
 const ACPX_PLUGIN_ID = "acpx";
-const ACPX_ENABLED_BY_DEFAULT = true;
+const ACPX_ENABLED_BY_DEFAULT = false;
 
 /**
  * Walk plugin config entries and collect SecretRef assignments for MCP server

src/secrets/target-registry-data.ts

@@ -322,6 +322,7 @@ const CORE_SECRET_TARGET_REGISTRY: SecretTargetRegistryEntry[] = [
     includeInPlan: true,
     includeInConfigure: true,
     includeInAudit: true,
+    providerIdPathSegmentIndex: 2,
   },
   {
     id: "tools.web.search.apiKey",