fix: close etappe-0 whole-branch review findings

- Autoloader: add automattic/jetpack-autoloader and load
  vendor/autoload_packages.php; require wordpress/mcp-adapter directly (^0.5).
- ServerRegistrar: make the adapter create_server() call and the
  OAuthServerRegistrar class_exists() check injectable so createServer()'s
  unhook-before-create ordering and the "mcp-oauth absent" branch are unit
  tested; add a smoke-test check that booting REST triggers no
  _doing_it_wrong().
- mcp-smoke.sh: assert mcp-adapter's default server route 404s, and that the
  subscriber role-gate denial actually carries our/the adapter's denial text
  (not just any isError/error).
- Guard tests/Integration/mint-token.php and tec-probe.php with
  `defined('WP_CLI') && WP_CLI || exit;`; add .gitattributes export-ignore
  for tests/docs-superpowers/.superpowers/phpunit/phpcs config.
- Security: add Server/RequestContext, tracking via
  rest_request_before_callbacks whether the current REST dispatch is our
  OAuth-protected /mcp/mcp-oauth-server route; AbilityRegistrar's
  permission_callback now denies (after the role gate) when abilities are
  invoked outside that route. Wired in Plugin::boot().
- Minors: single Plugin::VERSION constant used by ServerRegistrar;
  IntegrationRegistry caches its computed abilities list; tec-probe.php
  checks wp_insert_post's result and cleans up its probe post in a
  try/finally.

composer test: 47/47 green. composer lint: clean. Full mcp-smoke.sh run ends
ALL CHECKS PASSED (plus the expected /.well-known WARN).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Abilities/AbilityRegistrarTest.php

@@ -9,6 +9,7 @@ use LIT\MCP\Abilities\Ability;
 use LIT\MCP\Abilities\AbilityRegistrar;
 use LIT\MCP\Integrations\Integration;
 use LIT\MCP\Integrations\IntegrationRegistry;
+use LIT\MCP\Server\RequestContext;
 use LIT\MCP\Tests\Unit\TestCase;
 use Mockery;
 use RuntimeException;
@@ -16,6 +17,20 @@ use WP_Error;
 
 final class AbilityRegistrarTest extends TestCase
 {
+    protected function setUp(): void
+    {
+        parent::setUp();
+        // Default to "inside the OAuth server request" so tests unrelated to this
+        // gate keep exercising the ability's own permission() as before.
+        RequestContext::reset(true);
+    }
+
+    protected function tearDown(): void
+    {
+        RequestContext::reset();
+        parent::tearDown();
+    }
+
     private function registrarFor(Ability $ability): AbilityRegistrar
     {
         $integration = Mockery::mock(Integration::class);
@@ -64,6 +79,19 @@ final class AbilityRegistrarTest extends TestCase
         self::assertSame('lit_forbidden', $result->get_error_code());
     }
 
+    public function testPermissionDeniedOutsideOAuthServerRequest(): void
+    {
+        Functions\when('current_user_can')->justReturn(true);
+        RequestContext::reset(false);
+        $ability = $this->ability();
+        $ability->shouldNotReceive('permission');
+
+        $result = ($this->registrarFor($ability)->argsFor($ability)['permission_callback'])([]);
+
+        self::assertInstanceOf(WP_Error::class, $result);
+        self::assertSame('lit_forbidden', $result->get_error_code());
+    }
+
     public function testPermissionDelegatesToAbilityWhenGatePasses(): void
     {
         Functions\when('current_user_can')->justReturn(true);