fix(mcp): clear sticky reviewer denial on allowed author task route (#238)

Add sync_from_capability_result() so reviewer terminal mode is
operation-scoped: a later allowed author capability resolution clears
stale denial state and unblocks read-only tools like gitea_list_prs.

Error messages now name the denied task and explain how to clear stale
state. Inline trust-gate parsing fixes broken imports in
assess_capability_stop_report on master.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

tests/test_capability_stop_terminal.py

@@ -29,8 +29,8 @@ CONFIG = {
             "username": "jcwalker3",
             "auth": {"type": "env", "name": "GITEA_TOKEN_AUTHOR"},
             "allowed_operations": [
-                "gitea.read", "gitea.issue.create", "gitea.pr.create",
-                "gitea.branch.push",
+                "gitea.read", "gitea.issue.create", "gitea.issue.comment",
+                "gitea.pr.create", "gitea.branch.push",
             ],
             "forbidden_operations": [
                 "gitea.pr.approve", "gitea.pr.merge", "gitea.pr.review",
@@ -97,6 +97,30 @@ class TestCapabilityStopTerminal(unittest.TestCase):
             with self.assertRaises(RuntimeError) as ctx:
                 mcp_server.gitea_list_prs(remote="prgs")
         self.assertIn("Cannot perform reviewer task", str(ctx.exception))
+        self.assertIn("review_pr", str(ctx.exception))
+
+    @patch("mcp_server.api_get_all", return_value=[])
+    @patch("mcp_server.api_request", return_value={"login": "jcwalker3"})
+    @patch("mcp_server.get_auth_header", return_value="token author-pass")
+    def test_list_prs_allowed_after_author_task_clears_stale_denial(
+        self, _auth, _api, _get_all,
+    ):
+        with patch.dict(os.environ, self._env()):
+            denied = mcp_server.gitea_resolve_task_capability(
+                task="review_pr", remote="prgs"
+            )
+            self.assertTrue(denied["stop_required"])
+            self.assertTrue(capability_stop_terminal.is_active())
+
+            cleared = mcp_server.gitea_resolve_task_capability(
+                task="claim_issue", remote="prgs"
+            )
+            self.assertTrue(cleared["allowed_in_current_session"])
+            self.assertTrue(cleared.get("cleared_stale_denial"))
+            self.assertFalse(capability_stop_terminal.is_active())
+
+            prs = mcp_server.gitea_list_prs(remote="prgs")
+        self.assertEqual(prs, [])
 
     @patch("mcp_server.api_request", return_value={"login": "jcwalker3"})
     @patch("mcp_server.get_auth_header", return_value="token author-pass")