fix: report unavailable official MCP authentication support

[Dazai1623818]

Summary

• Report official HTTP MCP services as disabled with official_auth_unavailable when the standalone runtime lacks officialMcpAuth.trustedOrigins.
• Preserve explicit disablement and other authentication/transports. A later connection attempt can proceed when the registry becomes available; origin, certificate, and permission checks are not bypassed.
• Add an optional idempotent runtime patch, focused offline behavioral tests, documentation, and a release check for an enabled patch report.

This does not add official authentication support or globally disable document skills. The independent prompt preflight/input-preservation fix is intentionally excluded.

Verification

• Based on 828f398 (main), independently of the prompt-preflight branch.
• 33 focused runtime patch tests, TypeScript checking, and git diff --check passed.
• Validated the patch anchor, idempotency, and Node syntax against the checksum-verified npm zcode-app-cli@3.11.2-19 artifact (runtime 0.16.5).
• Earlier full combined-tree validation on f0d57aa: 604 passed, zero failed, plus runtime and package-tree checks. This is not a claim that the full suite has been rerun on this isolated branch.

No live official MCP authentication or paid model calls were used. Tests cover unavailable support, later registry availability, explicit disablement, unrelated transports/authentication, and incompatible or ambiguous patch anchors. No generated runtime files or private configuration are included.

[kingsword09]

LGTM！