feat(guard): native MCP transport binding and contaminated-review quarantine (Closes #695)

Bind mutation/credential paths to a process-local native MCP runtime so env
spoofing, direct imports, and offline helpers cannot reconstruct session gates
after native transport failure. Quarantine contaminated formal reviews under
controller authority and honor quarantine in review feedback, merge eligibility,
merge mutation, and canonical handoff validation. Add regression coverage for
the second (PR #694 / review 427) incident class.

tests/test_audit.py

@@ -329,13 +329,17 @@ class TestGatedToolAudit(_AuditWiringBase):
     @patch("mcp_server.api_request")
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_merge_success_audited(self, _auth, mock_api):
-        # user, pr, feedback pr+reviews, merge POST, readback.
+        # user, pr, eligibility feedback pr+reviews (#695), gate-7 feedback
+        # pr+reviews, merge POST, readback.
+        approval = [{
+            "id": 1, "user": {"login": "reviewer-bot"}, "state": "APPROVED",
+            "commit_id": "abc123", "submitted_at": "2026-07-06T10:00:00Z",
+            "dismissed": False,
+        }]
         mock_api.side_effect = [
             {"login": "merger-bot"}, self._pr("author-bot"),
-            self._pr("author-bot"),
-            [{"id": 1, "user": {"login": "reviewer-bot"}, "state": "APPROVED",
-              "commit_id": "abc123", "submitted_at": "2026-07-06T10:00:00Z",
-              "dismissed": False}],
+            self._pr("author-bot"), approval,  # eligibility merge feedback
+            self._pr("author-bot"), approval,  # gate 7 feedback
             {}, {"merged_commit_sha": "c1"},
         ]
         env = self._env(GITEA_PROFILE_NAME="gitea-merger",