fix: control-plane guide org/repo params and local repo alignment (#588)

#530's remote/repo guard blocked mcp_get_control_plane_guide(remote=prgs)
because the bare default resolves to Timesheet while local git is
Gitea-Tools, and remediation told callers to pass org/repo on a tool that
did not accept those parameters.

- Accept optional org/repo on mcp_get_control_plane_guide
- Prefer local git remote org/repo when bare defaults mismatch (read-only guide)
- Keep mutation tools fail-closed on bare mismatch
- Align remediation text with tools that accept org/repo

Closes #588

tests/test_operator_guide.py

@@ -88,6 +88,21 @@ class TestControlPlaneGuide(GuideTestBase):
         blob = " ".join(g["guidance"]).lower()
         self.assertIn("forbidden", blob)
         self.assertIn("review", blob)
+        self.assertIn("resolved_repository", g)
+
+    @patch("mcp_server.api_request", return_value={"login": "author-bot"})
+    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
+    def test_guide_explicit_org_repo_parameters(self, _auth, _api):
+        with patch.dict(os.environ, AUTHOR_ENV, clear=True):
+            g = mcp_get_control_plane_guide(
+                remote="prgs",
+                org="Scaled-Tech-Consulting",
+                repo="Gitea-Tools",
+            )
+        self.assertEqual(
+            g["resolved_repository"],
+            {"org": "Scaled-Tech-Consulting", "repo": "Gitea-Tools"},
+        )
 
     @patch("mcp_server.api_request", return_value={"login": "reviewer-bot"})
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)