mcp: heal stale preconfigured agent tokens on stdio startup

[khaliqgant]

Summary

• validate the preconfigured MCP agent token on stdio startup instead of blindly trusting it
• auto-heal stale/unauthorized tokens by calling registerOrRotate when the workspace key + agent name are available
• accept RELAY_CLAW_NAME as an alias for RELAY_AGENT_NAME
• add tests covering valid token reuse, stale token rotation, and name-only bootstrap

Why

We hit a confusing partial-success state in a real OpenClaw + Relaycast setup:

• workspace key/config was valid
• list_agents worked
• inbound messages injected correctly
• but post_message / reply_to_thread failed because the preconfigured RELAY_AGENT_TOKEN was stale/unauthorized

The MCP stdio process was trusting that token forever. This change makes startup defensive:

• if the token still works, keep it
• if it fails auth and we know the intended agent name, self-heal by rotating/refreshing it

Notes

This is the Relaycast-side half of the fix. The companion OpenClaw-side change should ensure setup passes the agent name through to the MCP environment so this startup healing has the identity it needs.

Validation

• npm exec vitest -- run packages/mcp/src/__tests__/transports.test.ts

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.

[github-actions]

Preview deployed!

Environment	URL
API	https://pr73-api.relaycast.dev
Health	https://pr73-api.relaycast.dev/health
Observer	https://pr73-observer.relaycast.dev/observer

This preview shares the staging database and will be cleaned up when the PR is merged or closed.

Run E2E tests

npm run e2e -- https://pr73-api.relaycast.dev --ci

Open observer dashboard

https://pr73-observer.relaycast.dev/observer