fix: resolve stale MCP runtime EOF follow-ups (#531)

- fail closed when runtime diagnostics fail unexpectedly
- move MCP connection healthcheck under scripts/
- document #543 as the remaining IDE namespace proof
- keep namespace binding test isolated from mocked git metadata

tests/test_mcp_stale_runtime.py

@@ -15,11 +15,11 @@ class TestMcpStaleRuntime(unittest.TestCase):
         # Setup mocks
         mock_getpid.return_value = 12345
         mock_exists.return_value = True
-        
+
         # Code modification time: Jul 8 2026, 14:00:00
         code_time = datetime(2026, 7, 8, 14, 0, 0)
         mock_getmtime.return_value = code_time.timestamp()
-        
+
         # Mock ps -ax output
         # PID 12345 is self (started at 13:00:00 - stale)
         # PID 54321 is prgs-author (started at 15:00:00 - fresh)
@@ -29,17 +29,17 @@ class TestMcpStaleRuntime(unittest.TestCase):
             "12345 Wed Jul  8 13:00:00 2026 /path/to/python mcp_server.py\n"
             "54321 Wed Jul  8 15:00:00 2026 /path/to/python mcp_server.py\n"
         )
-        
+
         mock_run_ps = MagicMock()
         mock_run_ps.stdout = ps_output
-        
+
         # Mock env output for ps eww
         mock_run_env12345 = MagicMock()
         mock_run_env12345.stdout = "GITEA_MCP_PROFILE=prgs-reconciler"
-        
+
         mock_run_env54321 = MagicMock()
         mock_run_env54321.stdout = "GITEA_MCP_PROFILE=prgs-author"
-        
+
         def side_effect(args, **kwargs):
             if args[0] == "ps" and "eww" in args:
                 pid = args[2]
@@ -50,18 +50,18 @@ class TestMcpStaleRuntime(unittest.TestCase):
             elif args[0] == "ps":
                 return mock_run_ps
             raise ValueError(f"Unexpected subprocess run args: {args}")
-            
+
         mock_run.side_effect = side_effect
-        
+
         # Test 1: required reviewer role matching prgs-reviewer (which is missing)
         reasons = gitea_mcp_server._check_mcp_runtimes_diagnostics("review_pr", ["prgs-reviewer"])
-        
+
         self.assertTrue(any("stale-runtime: The active Gitea MCP server process is stale" in r for r in reasons))
         self.assertTrue(any("stale-runtime: None of the matching profiles for task" in r for r in reasons))
-        
+
         # Test 2: required author role matching prgs-author (which is fresh)
         reasons_author = gitea_mcp_server._check_mcp_runtimes_diagnostics("create_issue", ["prgs-author"])
-        
+
         # Still contains self stale error
         self.assertTrue(any("stale-runtime: The active Gitea MCP server process is stale" in r for r in reasons_author))
         # But does NOT contain missing author profile error

tests/test_namespace_workspace_binding.py

@@ -234,7 +234,20 @@ class TestNamespaceWorkspaceIntegration(unittest.TestCase):
         mock_run.return_value = MagicMock(returncode=0, stdout=f"{CONTROL_ROOT}/.git\n")
         os.environ[nwb.AUTHOR_WORKTREE_ENV] = AUTHOR_DIRTY
         srv._preflight_resolved_role = "reviewer"
+        clean_git_state = {
+            "current_branch": "master",
+            "porcelain_status": "",
+            "head_sha": "abc123",
+        }
         with mock.patch.object(srv, "PROJECT_ROOT", MCP_PROCESS_ROOT):
             with mock.patch("gitea_mcp_server.get_profile", return_value=self._merger_profile()):
-                resolved = srv._verify_role_mutation_workspace("prgs")
-        self.assertEqual(resolved, os.path.realpath(MCP_PROCESS_ROOT))
+                with mock.patch(
+                    "gitea_mcp_server.issue_lock_worktree.read_worktree_git_state",
+                    return_value=clean_git_state,
+                ):
+                    with mock.patch(
+                        "gitea_mcp_server.root_checkout_guard.resolve_remote_master_sha",
+                        return_value="abc123",
+                    ):
+                        resolved = srv._verify_role_mutation_workspace("prgs")
+        self.assertEqual(resolved, os.path.realpath(MCP_PROCESS_ROOT))