[bug] 1.6.10 still caps MCP OAuth scopes at 100 (fixed in #2056, unreleased); tool-sync error hides the 403 #2321

Summary

The latest stable release, executor@1.6.10 (published 2026-09-18 17:28 UTC), still caps discovered OAuth
scopes at 100. #2056 ("Request all advertised OAuth scopes", merged 2026-09-18 18:52 UTC) fixes it on main,
84 minutes after 1.6.10 shipped. Its changeset (.changeset/oauth-discovered-scope-budget.md) is still pending,
so no stable release contains the fix. Every 1.x user connecting PostHog MCP gets zero tools.

Request: cut a 1.6.11 patch release with the pending changesets.

Reproduction (executor 1.6.10, darwin-arm64, local daemon)

1. Add the PostHog MCP integration (https://mcp.posthog.com/mcp) and connect with OAuth (CIMD client).
2. Connection health: degraded, detail
   Tool sync failing: Failed connecting to MCP server: Failed connecting via streamable-http. 0 tools.
3. https://mcp.posthog.com/.well-known/oauth-protected-resource/mcp advertises 154 scopes. The stored grant has
   exactly 100: the list is cut after organization:read, dropping user:read, project:read, query:read, etc.
   The bundled code: m=(re)=>FE(re).slice(0,100).
4. Calling the MCP endpoint with the stored token returns:
   HTTP 403 Missing PostHog API scope: 'user:read'.

Workaround used: start oauth.start, then replace the scope parameter of the returned authorization URL with
an explicit list under 100 (the 84 read scopes plus openid profile email introspection). The callback accepted
it and the tools synced.

Second issue: the sync error discards the HTTP status

The daemon log and connection health only say Failed connecting via streamable-http. The server's actual
response was a 403 with a precise message (Missing PostHog API scope: 'user:read'). Surfacing the status and
the first part of the body in the tool-sync verdict would have made this a one-minute diagnosis. #2056 keeps the
verdict visible but, as far as I can tell, not the underlying status or body.

Notes

• 2.0.0-beta.25 does not appear affected: packages/sdk/src/implementation/oauth-protocol.ts:1345 requests every
  advertised resource scope.
• A per-integration scope override in oauth.start (or the MCP integration config) would also help users who
  want a least-privilege grant, e.g. read-only PostHog. Related: [feature] Allow selecting Cloudflare Developer Platform MCP OAuth scopes #2233.