Add hosted MCP tool selectors

[hmishra2250]

Summary

• Adds exact-replacement hosted MCP selection with ?tools=.
• Freezes versioned presets as literal contract data:
  • @core-v1: firecrawl_search, firecrawl_scrape, firecrawl_parse
  • @full-v1: the immutable 26-tool v1 set (it cannot drift with the live registry)
• Keeps bare /v2/mcp and /v2/mcp-oauth defaults unchanged.
• Rejects selectors on frozen marketplace profiles such as /v2/mcp-search.
• Preserves correction-only invalid-credential behavior before selector entitlement checks.
• Pins selector errors:
  • invalid selector: HTTP 400 / JSON-RPC -32602
  • unavailable selector: HTTP 403 / JSON-RPC -32003
  • direct unselected call: normal MCP error result

Instruction-copy isolation

Shipping instructions remain byte-identical by default, including /v2/mcp-oauth while the OpenAI metadata surface is frozen. The capability-honest candidate is experiment-only:

• flag: MCP_OPTIMIZED_INSTRUCTIONS_ENABLED=true
• allowed process: /v2/mcp only
• default: off
• candidate SHA-256 is contract-frozen
• readiness fails if the flag is enabled on another endpoint

The auth hook runs before FastMCP parses the JSON-RPC body, so selector transport errors are contract-tested at the HTTP/JSON-RPC boundary.

Current evidence for this PR head

Head: 8041d1f785f77f5d7981b1a36db7c157edc139ad

Validation evidence:

• Hosted MCP contract version: 1.2.0
• Hosted MCP contract digest: ae509af4600be3a69f8fa8556ccc14dd508ea6a9c0b7a80870751efb24301650
• Full local MCP-server suite: 83/83 passed
• Additional local checks passed:
  • npm run typecheck
  • npm run lint
  • npm run build
  • npm run check:hosted-mcp-contract
  • targeted hosted contract/nginx suite: 37/37 passed

Selector behavior covered by tests:

• /v2/mcp?tools=@core-v1 lists only the core preset for anonymous keyless sessions.
• Explicit ?tools= selection replaces defaults and gates direct calls.
• Invalid/repeated selectors reject before dispatch.
• Credential-ineligible selectors reject atomically.
• Invalid bearer credentials stay correction-only and do not downgrade to keyless.
• /v2/mcp-oauth?tools=@full-v1 preserves the immutable 26-tool v1 set.
• Marketplace /v2/mcp-search rejects selector query parameters.

Mandatory retained-branch release rule

This Train 3 MCP-server draft intentionally targets the unmerged Train 2 parent branch feature/anthropic-mcp-search-profile from PR #317. After #317 merges, retarget this PR to main, rebase/update the branch, rerun required CI, and verify the PR diff contains only this child Train 3 delta. Do not merge this child PR while its base is the retained feature branch; doing so would update the feature branch rather than main and bypass the intended release boundary.

Draft only. Do not merge, deploy, or close from this PR directly. Himadri reviews before merge.