Fix feature flag checker and add insiders mode support

[kerobbi]

Summary

Fixes feature flag checking for STDIO and HTTP modes, and adds insiders mode support for HTTP.

Why

Fixes #

What changed

• Uncommented WithFeatureChecker(featureChecker) in STDIO inventory builder
• Added X-MCP-Insiders and X-MCP-Features headers parsing in middleware
• Added new routes /insiders, /readonly/insiders, /x/{toolset}/insiders, and /x/{toolset}/readonly/insiders
• Added ctx helpers WithInsidersMode / IsInsidersMode and WithHeaderFeatures / GetHeaderFeatures
• Updated GetFlags to now read InsidersMode from ctx
• Removed unused Flags field from RequestDeps
• Fixed docs to use "append /insiders" pattern instead of prepend
• Added tests for X-MCP-Features header parsing

MCP impact

• No tool or API changes
• Tool schema or behavior changed
• New tool added

Prompts tested (tool changes only)

Security / limits

• No security or limits impact
• Auth / permissions considered
• Data exposure, filtering, or token/size limits considered

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR

Note: if you're renaming tools, you must add the tool aliases. For more information on how to do so, please refer to the official docs.

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed
• Updated (README / docs / examples)

[Copilot]

Pull request overview

This PR fixes feature flag checking functionality for both STDIO and HTTP modes, and adds comprehensive insiders mode support for the HTTP server. The changes enable early access features to be properly gated behind insiders mode and feature flags that can be passed via headers or URL paths.

Changes:

• Uncommented the WithFeatureChecker call in STDIO mode to activate feature flag checking
• Added HTTP-specific feature checker that validates header-based feature flags against a whitelist
• Implemented insiders mode support with new context helpers and URL routes (/insiders, /readonly/insiders, etc.)
• Added X-MCP-Insiders and X-MCP-Features header parsing in middleware
• Removed unused Flags field from RequestDeps and refactored GetFlags to read from context dynamically
• Deleted redundant features.go file in favor of integrated feature checker in server.go

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
internal/ghmcp/server.go	Uncommented feature checker registration for STDIO mode
pkg/http/server.go	Added createHTTPFeatureChecker function with whitelist validation and moved feature flag logic from deleted features.go
pkg/http/handler.go	Added insiders mode routes and middleware, updated inventory factory to use feature checker
pkg/http/middleware/request_config.go	Added parsing for X-MCP-Insiders and X-MCP-Features headers
pkg/http/headers/headers.go	Added constants for new MCP headers
pkg/context/request.go	Added context helpers for insiders mode and header features
pkg/github/dependencies.go	Removed unused Flags field from RequestDeps and updated GetFlags to read InsidersMode from context
pkg/http/features.go	Deleted file - functionality moved to server.go
docs/remote-server.md	Updated route documentation to correct the pattern from prepend to append (/readonly/insiders instead of /insiders/readonly)