fix(mcp): gate maintainer-noise behind maintainer approval/write access

[JSONbored]

Motivation

• Close an authorization gap where the gittensory_get_maintainer_noise MCP tool used the cached requireRepoAccess gate and could return maintainer-only queue-noise analytics to a session with stale/cached MEMBER/COLLABORATOR evidence instead of requiring live maintainer/write permission.

Description

• Replace the read/cached gate call with the stricter maintainer/write gate by changing await this.requireRepoAccess(fullName) to await this.requireRepoApprovalQueueAccess(fullName) in src/mcp/server.ts for getMaintainerNoise.
• Allow test harness instantiation with an explicit session identity by adding an optional identity parameter to connectTestClient in test/unit/mcp-output-schemas.test.ts so MCP server tests can simulate session identities.
• Add a regression test that asserts a session whose only cached evidence is an authored PR with author_association: "MEMBER" is denied access to gittensory_get_maintainer_noise (the test checks the returned error and that no structured content is exposed).

Testing

• Ran git diff --check which produced no whitespace or conflict errors and passed locally.
• Ran npm run typecheck (tsc --noEmit) which completed successfully with no type errors.
• Ran the focused test suite npx vitest run test/unit/mcp-output-schemas.test.ts -t "maintainer_noise" --reporter=verbose and the added regression plus the maintainer-noise validation tests passed; an earlier attempt to run the entire file experienced timeouts on unrelated, pre-existing tests, but the targeted regression and schema checks for this change succeeded.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.44%. Comparing base (8309b23) to head (a5416bd).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1464   +/-   ##
=======================================
  Coverage   95.44%   95.44%           
=======================================
  Files         194      194           
  Lines       21054    21054           
  Branches     7619     7619           
=======================================
  Hits        20094    20094           
  Misses        383      383           
  Partials      577      577           

Files with missing lines	Coverage Δ
src/mcp/server.ts	95.61% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.