feat(mcp): Phase 9 — optional overlay auth preflight

[erishforG]

무엇

MCP tools/call preflight now blocks explicitly requested optional GitHub overlays when no delegated GitHub token is present.

왜

Refs #294. The auth spec says optional PR/CI overlays should be checked before handlers run, instead of silently reaching tool logic without credential context.

변경

• Added argument-aware MCP preflight for worktree_list.include_pr, worktree_list.include_ci, and health_check.include_ci.
• Added stdio fixture coverage for optional PR/CI overlay AUTH_REQUIRED responses.
• Documented the auth implementation phase in docs/mcp/auth.md.

다음 Phase 힌트

Track delegated token scope metadata in McpContext so preflight can return INSUFFICIENT_SCOPE when a token is present but missing requested scopes.

리스크

Low. The change is isolated to src/mcp/, tests/mcp/, and docs/mcp/; it only affects explicitly requested GitHub overlays without delegated auth.

롤백

Revert the preflight helper and the two fixture records. Existing required-tool auth preflight remains independent.

Test plan

• cargo build --quiet
• cargo fmt --check
• cargo clippy --all-targets -- -D warnings
• cargo test --quiet

@erishforG

[erishforG]

Closing as superseded by #377, which implemented the same optional overlay auth preflight with the more general github_scopes-based path and passed the full verification set. #378 has also been merged for the fixture update.