Fixes two more hang causes in "Explain this" / "Suggest a fix": missing --strict-mcp-config/--permission-mode dontAsk (was waiting on globally configured MCP servers before answering) and a cwd inside a TCC-protected folder (now pinned to the OS temp dir, safe since these calls never touch the filesystem). Also adds a Test button next to the Claude Code auth token field in Settings -> Advanced, so a token can be verified in place.