Repair or report the failing github MCP server

[ExtraToast]

Parent

SSO-gated install: #41

Moved from epic #44 on 2026-09-14. The other five #44 fixes have shipped; this
one failed with a malformed credential, which is credential distribution, so
it lands with #41 rather than in a setup-script pull request.

What to build

The github MCP server connects, or the run says clearly that it cannot and
why — instead of leaving a permanently failing server that looks like a
missing capability.

On this host it fails with:

plugin:github:github: https://api.githubcopilot.com/mcp/ (HTTP)
  ✘ Failed to connect — HTTP 400: Error POSTing to endpoint:
    bad request: Authorization header is badly formatted

That message reads like an unconfigured server rather than a malformed
credential, which is why it has survived unnoticed across sessions. The
server is owned by the github plugin, not by the registry, so the
setup script cannot rewrite its configuration — but it can detect the failure
and report it with the fix.

Find out what the plugin actually expects — a token in a specific env var, a
gh auth login, or an OAuth flow — and either satisfy it from the estate's
existing GitHub credential or record that it needs a per-host token, in which
case it belongs with the credential-distribution work rather than here.

Note the estate constraint while testing: the prefixed label taxonomy means
plain bug and enhancement do not exist in most repos, so a label write
through this server fails for reasons unrelated to authentication.

Acceptance criteria

• The cause of the 400 is identified — not guessed — and written down.
• The server connects, or the ticket records exactly which credential is
  missing and where it must come from.
• The setup run reports a failing plugin-owned MCP server rather than
  passing over it silently.
• A read call through the server succeeds against a real repository.