feat(mcp): Phase 3 — auth preflight

[erishforG]

무엇

GitHub-backed MCP tools now return a structured AUTH_REQUIRED tools/call envelope before dispatch when no delegated token is present.

왜

Refs #294. This advances the v1.0 MCP auth track by enforcing the documented required-token boundary in src/mcp/ without touching shared CLI or worktree logic. @erishforG

변경

• Added MCP tools/call preflight for requires_github tools.
• Returned auth failures through the normal MCP content envelope with required scope detail.
• Added a stdio fixture assertion for pr_status without auth.
• Updated the auth phase table to reflect AUTH_REQUIRED implementation.

다음 Phase 힌트

• Add delegated token ingestion from MCP client/session metadata.
• Add scope validation once token capabilities are modeled.
• Add fixture scrubbing rules for token-bearing recordings.

리스크

Low: changes are isolated to src/mcp/, tests/mcp/, and docs/mcp/; no existing CLI surface or git/worktree mutation path changes.

롤백

Revert this commit to return GitHub-backed tools to the previous stub-dispatch behavior.

Test plan

• cargo fmt --check
• cargo build --quiet
• cargo clippy --all-targets -- -D warnings
• cargo test --quiet