fix: harden setup, MCP, and external boundary contracts

[morluto]

Description

Twenty open issues exposed inconsistent validation and diagnostics at capability boundaries. Schema limits were not always enforced at runtime, setup could discover corpus blockers after planning other work, and several adapters collapsed distinct failure states.

This change aligns those contracts:

Area	Issues	Outcome
Scalable MCP operations	#87, #89, #90, #92, #97, #99, #101	Enforce request, page, and item bounds; preserve first-seen order while deduplicating inputs.
Setup lifecycle	#91, #93, #94, #95, #96	Inspect corpus compatibility before other setup work and report the blocking state with a recovery command. Dry-run and real setup use the same preflight.
Search and DeepWiki	#98, #100, #106	Return usable search examples, send normalized repositories, and cover provider/transport mapping through a narrow adapter seam.
Redaction and GitHub policy	#102, #103	Reuse canonical credential redaction and reopen timed-out half-open circuit probes with a fresh cooldown.
Local execution boundaries	#88, #104, #105	Distinguish source checkouts from incomplete npm artifacts, reject invalid or symlinked mirrors, and accept valid SCP-style remotes without usernames.

Key invariants:

• An accepted authored-sync budget can fund identity lookup, discovery, and at least one repository refresh.
• Thread item limits count retained matches after filtering, not raw API rows.
• Setup performs corpus compatibility inspection before network access or local configuration writes in both dry-run and real modes.
• An existing mirror is reusable only when it is a direct, bare repository with the expected origin.
• A timed-out half-open circuit probe starts a new cooldown before another probe is admitted.

No corpus schema, dependency, or public third-party type changes are included.

Suggested review order

1. MCP bounds and synchronization invariants in internal/app/mcp_scalable_operations.go, internal/app/sync_headers.go, and internal/mcpserver/scalable.go.
2. Setup side-effect ordering in internal/app/setup.go and the CLI diagnostics.
3. Circuit-breaker and workspace state transitions.
4. DeepWiki, redaction, remote-validation, and npm adapter changes.
5. Regression tests alongside each owner boundary.

Testing Done

• go test ./...
• go vet ./...
• golangci-lint run --timeout=5m --new-from-rev=origin/main (0 issues)
• go test -race ./internal/github ./internal/app
• go test -race ./internal/corpus
• npm run test:npm (4 tests)
• npm run test:e2e (5 tests)
• npm pack --dry-run
• go mod tidy (no diff)

Checklist

• Focused regression tests cover ordering, bounds, side-effect sequencing, timeout recovery, and filesystem validation.
• Storage invariants are unchanged.
• gofmt applied to changed Go files.
• No new third-party types exposed outside adapters.

Closes #87
Closes #88
Closes #89
Closes #90
Closes #91
Closes #92
Closes #93
Closes #94
Closes #95
Closes #96
Closes #97
Closes #98
Closes #99
Closes #100
Closes #101
Closes #102
Closes #103
Closes #104
Closes #105
Closes #106

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.