fix: close etappe-0 whole-branch review findings

- Autoloader: add automattic/jetpack-autoloader and load
  vendor/autoload_packages.php; require wordpress/mcp-adapter directly (^0.5).
- ServerRegistrar: make the adapter create_server() call and the
  OAuthServerRegistrar class_exists() check injectable so createServer()'s
  unhook-before-create ordering and the "mcp-oauth absent" branch are unit
  tested; add a smoke-test check that booting REST triggers no
  _doing_it_wrong().
- mcp-smoke.sh: assert mcp-adapter's default server route 404s, and that the
  subscriber role-gate denial actually carries our/the adapter's denial text
  (not just any isError/error).
- Guard tests/Integration/mint-token.php and tec-probe.php with
  `defined('WP_CLI') && WP_CLI || exit;`; add .gitattributes export-ignore
  for tests/docs-superpowers/.superpowers/phpunit/phpcs config.
- Security: add Server/RequestContext, tracking via
  rest_request_before_callbacks whether the current REST dispatch is our
  OAuth-protected /mcp/mcp-oauth-server route; AbilityRegistrar's
  permission_callback now denies (after the role gate) when abilities are
  invoked outside that route. Wired in Plugin::boot().
- Minors: single Plugin::VERSION constant used by ServerRegistrar;
  IntegrationRegistry caches its computed abilities list; tec-probe.php
  checks wp_insert_post's result and cleans up its probe post in a
  try/finally.

composer test: 47/47 green. composer lint: clean. Full mcp-smoke.sh run ends
ALL CHECKS PASSED (plus the expected /.well-known WARN).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Server/ServerRegistrar.php

@@ -6,6 +6,7 @@ namespace LIT\MCP\Server;
 
 use LIT\MCP\Guides\InstructionsBuilder;
 use LIT\MCP\Integrations\IntegrationRegistry;
+use LIT\MCP\Plugin;
 use WP\MCP\Core\McpAdapter;
 use WP\MCP\Infrastructure\ErrorHandling\ErrorLogMcpErrorHandler;
 use WPMedia\MCP\OAuth\Context as OAuthContext;
@@ -41,13 +42,38 @@ final class ServerRegistrar
     /** @var callable(): bool */
     private $oauthEnabled;
 
+    /** @var callable(array<string, mixed>): mixed */
+    private $createAdapterServer;
+
+    /** @var callable(string): bool */
+    private $classExists;
+
     public function __construct(
         private IntegrationRegistry $registry,
         private InstructionsBuilder $instructions,
-        ?callable $oauthEnabled = null
+        ?callable $oauthEnabled = null,
+        ?callable $createAdapterServer = null,
+        ?callable $classExists = null
     ) {
         $this->oauthEnabled = $oauthEnabled
             ?? static fn (): bool => (new OAuthContext())->is_enabled();
+        $this->classExists = $classExists
+            ?? static fn (string $class): bool => class_exists($class);
+        $this->createAdapterServer = $createAdapterServer
+            ?? static function (array $args): mixed {
+                return McpAdapter::instance()->create_server(
+                    $args['id'],
+                    $args['namespace'],
+                    $args['route'],
+                    $args['name'],
+                    $args['description'],
+                    $args['version'],
+                    [OAuthHttpTransport::class],
+                    ErrorLogMcpErrorHandler::class,
+                    (new OAuthContext())->observability_handler(),
+                    $args['tools']
+                );
+            };
     }
 
     public function register(): void
@@ -75,7 +101,7 @@ final class ServerRegistrar
             'route' => self::ROUTE,
             'name' => 'LIT MCP',
             'description' => $this->instructions->build(),
-            'version' => '0.1.0',
+            'version' => Plugin::VERSION,
             'tools' => array_merge($this->registry->directAbilityNames(), self::META_TOOLS),
         ];
     }
@@ -97,18 +123,7 @@ final class ServerRegistrar
 
         $this->unhookOAuthDefaultServer();
 
-        $result = McpAdapter::instance()->create_server(
-            $args['id'],
-            $args['namespace'],
-            $args['route'],
-            $args['name'],
-            $args['description'],
-            $args['version'],
-            [OAuthHttpTransport::class],
-            ErrorLogMcpErrorHandler::class,
-            (new OAuthContext())->observability_handler(),
-            $args['tools']
-        );
+        $result = ($this->createAdapterServer)($args);
 
         if (is_wp_error($result)) {
             $message = '[wp-lit-mcp] MCP server registration failed: ' . $result->get_error_message();
@@ -129,7 +144,7 @@ final class ServerRegistrar
      */
     public function unhookOAuthDefaultServer(): void
     {
-        if (! class_exists(OAuthServerRegistrar::class)) {
+        if (! ($this->classExists)(OAuthServerRegistrar::class)) {
             return;
         }