fix: resolve stale MCP runtime EOF follow-ups (#531)

- fail closed when runtime diagnostics fail unexpectedly
- move MCP connection healthcheck under scripts/
- document #543 as the remaining IDE namespace proof
- keep namespace binding test isolated from mocked git metadata

tests/test_namespace_workspace_binding.py

@@ -234,7 +234,20 @@ class TestNamespaceWorkspaceIntegration(unittest.TestCase):
         mock_run.return_value = MagicMock(returncode=0, stdout=f"{CONTROL_ROOT}/.git\n")
         os.environ[nwb.AUTHOR_WORKTREE_ENV] = AUTHOR_DIRTY
         srv._preflight_resolved_role = "reviewer"
+        clean_git_state = {
+            "current_branch": "master",
+            "porcelain_status": "",
+            "head_sha": "abc123",
+        }
         with mock.patch.object(srv, "PROJECT_ROOT", MCP_PROCESS_ROOT):
             with mock.patch("gitea_mcp_server.get_profile", return_value=self._merger_profile()):
-                resolved = srv._verify_role_mutation_workspace("prgs")
-        self.assertEqual(resolved, os.path.realpath(MCP_PROCESS_ROOT))
+                with mock.patch(
+                    "gitea_mcp_server.issue_lock_worktree.read_worktree_git_state",
+                    return_value=clean_git_state,
+                ):
+                    with mock.patch(
+                        "gitea_mcp_server.root_checkout_guard.resolve_remote_master_sha",
+                        return_value="abc123",
+                    ):
+                        resolved = srv._verify_role_mutation_workspace("prgs")
+        self.assertEqual(resolved, os.path.realpath(MCP_PROCESS_ROOT))