feat: integrate mock server with gitea-tools remote resolution and correct verdict parser

- Fix allowedTools options inside run_compliance to support prefixless and prefixed tool access
- Implement sys.executable resolution to allow compliance runner to run safely inside git worktrees
- Dynamically load GITEA_MCP_CONFIG JSON profiles inside gitea_auth.py to support 'mock' remote name
- Implement gitea_url helper inside gitea_auth.py to automatically handle HTTP and HTTPS scheme differences for localhost/loopback mock targets, preventing wrong SSL version errors
- Fix verdict.py escaping mismatch by normalizing stream-json block output structure before matching strings, allowing PR view decision points to be verified correctly

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

gitea_auth.py

@@ -56,6 +56,26 @@ REMOTES = {
     },
 }
 
+# Load additional profiles from the JSON configuration if present
+try:
+    import urllib.parse
+    _config = gitea_config.load_config()
+    if _config and "profiles" in _config:
+        for _name, _prof in _config["profiles"].items():
+            if "base_url" in _prof:
+                _url = urllib.parse.urlparse(_prof["base_url"])
+                _host = _url.netloc or _url.path
+                REMOTES[_name] = {
+                    "host": _host,
+                    "org": _prof.get("default_owner") or "Scaled-Tech-Consulting",
+                    "repo": _prof.get("default_repo") or "Gitea-Tools",
+                }
+        if "mock-compliance" in _config["profiles"] and "mock" not in REMOTES:
+            REMOTES["mock"] = REMOTES["mock-compliance"]
+except Exception:
+    pass
+
+
 
 def get_credentials(host):
     """Return (user, password) for *host* via environment variables or keychain fallback."""
@@ -400,9 +420,24 @@ def api_get_all(url, auth_header, *, limit=None, page_size=50, max_pages=100,
     return results
 
 
+def gitea_url(host, path):
+    """Build a full URL for *host* and *path*, using http for loopback and https for others."""
+    if not path.startswith("/"):
+        path = "/" + path
+    if host.startswith("http://") or host.startswith("https://"):
+        return f"{host.rstrip('/')}{path}"
+    # Use HTTP for loopback targets, HTTPS for external
+    is_loopback = False
+    clean_host = host.split(":")[0]
+    if clean_host in ("localhost", "127.0.0.1", "::1") or clean_host.startswith("127."):
+        is_loopback = True
+    scheme = "http" if is_loopback else "https"
+    return f"{scheme}://{host}{path}"
+
+
 def repo_api_url(host, org, repo):
     """Return the base API URL for a repo: https://host/api/v1/repos/org/repo"""
-    return f"https://{host}/api/v1/repos/{org}/{repo}"
+    return gitea_url(host, f"/api/v1/repos/{org}/{repo}")
 
 
 def get_profile():