fix(mcp)!: return a compact binary_session status by default (#7127)

* fix(mcp)!: return a compact binary_session status by default

binary_session {} with no target open returned about 66 KB, most of it
provider rejection diagnostics and candidate capability sets that the
skill's recovery flow re-reads on every retry. 6.8.0 grew it by 21%
because the shared regex capability limitation began repeating setting
bounds and step-by-step recovery for every search operation of every
provider (#6099, #6267, #6301, #7049) and IDA gained that limitation for
its two search operations (#4862).

The regex limitation now states the effective deadline and heap, their
sources and where to change them; the deadline and heap errors keep the
full recovery. binary_session gains detail: summary (default) or
complete. The summary keeps open state, target identity, the binding,
route capabilities, run, activity and health status, each candidate's
availability and target-support status, code and reason, and every
tool's availability, reason, remediation and modes, and lists the
fields it leaves out in omitted_fields. Complete detail returns the
previous shape. The CLI capabilities and providers commands keep
complete provider facts through the same application projection.

BREAKING CHANGE: binary_session {} no longer returns
analysis_provider_candidates[].availability.diagnostics,
target_support.diagnostics or capabilities, or tool_availability group
surface, effects and annotations. Pass {"detail": "complete"} to get
them.

Fixes #7109

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(mcp): key binary_session output fields by detail

The output schema accepted detail: "complete" with summary candidates or
tool groups, and a summary without omitted_fields, so detail did not
tell callers which fields existed. Each session kind is now crossed
with a detail-specific shape: a summary requires omitted_fields and
summary-only candidates and tool groups; complete requires diagnostics,
candidate capabilities and static tool flags and forbids omitted_fields.
Both the canonical schema and the SDK-validated advertised schema reject
mismatched shapes.

The verifier helper accepts summary candidates only for a validated MCP
summary; CLI provider output still requires candidate capabilities.
Regex limitation tests check values, sources and setting names instead
of whole sentences.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

scripts/lib/mcp-verifier-results.mjs

@@ -45,13 +45,19 @@ const operationResultKey = (contract) => {
   return evidence ? "normalized_result" : "result";
 };
 
-/** Expand compact session metadata once at the verifier boundary. */
+/**
+ * Expand compact session metadata once at the verifier boundary. The caller
+ * has validated the status against the binary_session contract, so a summary
+ * carries summary candidates without capability sets; complete detail must
+ * still expand every candidate's capabilities.
+ */
 export const expandMcpSessionStatus = (status) => ({
   ...status,
   capabilities: expandProviderCapabilities(status.capabilities),
-  analysis_provider_candidates: expandProviderCandidates(
-    status.analysis_provider_candidates,
-  ),
+  analysis_provider_candidates:
+    status.detail === "summary"
+      ? status.analysis_provider_candidates
+      : expandProviderCandidates(status.analysis_provider_candidates),
   tool_availability: expandToolAvailability(status.tool_availability),
 });