fix(mcp): remediate B8, B6/B11, and B15 break-glass restart blockers (#664)

- B8: Correct redaction boundary for GITEA_TOKEN= and URI userinfo without destroying adjacent audit evidence or benign sec- text
- B6/B11: Remove false restart execution claims from default executor when GITEA_SANCTIONED_RESTART_HOOK is non-empty
- B15: Document deployable production grant set (runtime.break_glass_restart and gitea.issue.create) for prgs-controller
- Preserve B13, B1, B14 and previously accepted corrections

gitea_mcp_server.py

@@ -23936,37 +23936,35 @@ _break_glass_restart_executor = None
 def _default_break_glass_restart_executor(request: dict) -> dict:
     """Canonical non-dry-run break-glass executor/delegate (#664 B6/B11).
 
-    Never kills, signals, or restarts the live MCP cohort in-process. When a
-    sanctioned host-managed restart hook reference is configured
-    (``GITEA_SANCTIONED_RESTART_HOOK``), the request is *delegated* to that
-    host supervisor and the contract reports proven execution only for the
-    accepted handoff. Without a configured hook, apply is unsupported.
+    Never kills, signals, or restarts the live MCP cohort in-process.
+    An environment string alone (``GITEA_SANCTIONED_RESTART_HOOK``) does not
+    prove restart execution without an active confirmed delegate handoff.
     """
     hook = (os.environ.get("GITEA_SANCTIONED_RESTART_HOOK") or "").strip()
-    if not hook:
+    if hook:
         return {
             "success": False,
-            "apply_supported": False,
-            "apply_authorized": False,
+            "apply_supported": True,
+            "apply_authorized": True,
             "restart_performed": False,
             "break_glass_executed": False,
-            "execution_mode": "unsupported",
+            "execution_mode": "accepted_not_executed",
+            "host_hook_configured": True,
             "reasons": [
-                "break-glass apply is unsupported: no sanctioned host restart "
-                "hook is configured (GITEA_SANCTIONED_RESTART_HOOK) (#664)"
+                "sanctioned host restart hook reference is configured, but environment text "
+                "cannot prove execution without a confirmed delegate handoff (fail closed) (#664 B6/B11)"
             ],
         }
-    # Opaque host reference only — never treat the hook string as a command.
     return {
-        "success": True,
-        "apply_supported": True,
-        "apply_authorized": True,
-        "restart_performed": True,
-        "break_glass_executed": True,
-        "execution_mode": "host_delegate_accepted",
-        "host_hook_configured": True,
+        "success": False,
+        "apply_supported": False,
+        "apply_authorized": False,
+        "restart_performed": False,
+        "break_glass_executed": False,
+        "execution_mode": "unsupported",
         "reasons": [
-            "break-glass restart delegated to sanctioned host supervisor (#664)"
+            "break-glass apply is unsupported: no sanctioned host restart "
+            "executor is configured (#664)"
         ],
     }