feat(mcp): Phase 9 — optional overlay auth preflight

[erishforG]

무엇

@erishforG MCP tools/call preflight now rejects explicitly requested GitHub-backed optional overlays when no delegated token is present.

왜

Refs #294. docs/mcp/spec.md defines optional overlays such as PR/CI status as GitHub-backed behavior that should require delegated auth when requested. This keeps local-only calls working while making explicit overlay requests fail predictably.

변경

• Pass tools/call arguments into MCP preflight.
• Detect explicit include_pr / include_ci requests and return the existing AUTH_REQUIRED MCP error envelope without dispatching handlers.
• Add unit coverage and a stdio smoke fixture for the optional overlay auth contract.

다음 Phase 힌트

• Track delegated token scopes separately from token presence so INSUFFICIENT_SCOPE can be returned when a token lacks pull_request:read or checks:read.

리스크

Low. Change is isolated to src/mcp/ dispatcher preflight plus MCP fixtures; no CLI surface or worktree core logic changes.

롤백

Revert this commit to restore previous behavior where optional overlay arguments were not checked before handler dispatch.

Test plan

• cargo build --quiet
• cargo fmt --check
• cargo clippy --all-targets -- -D warnings
• cargo test --quiet