fix: unblock agent-native Development verification

[CountableNewt]

What changed

• retry a GitHub tarball fetch once without authorization only after an authenticated 401
• remove the rejected bearer token and authenticated redirect delegate from the fallback request
• preserve the original 401 when the anonymous retry fails, so private repositories remain fail-closed
• expose stable task identity in both nested context.task and the one-release top-level compatibility surface
• preserve and prioritize top-level task identity in the runtime context mapper
• add deterministic source-fetch, schema, and task-context tests

Why

Development verification found two blockers:

1. The central-skills webhook reached Gateway, but an expired account OAuth token caused the public repository tarball fetch to fail with 401.
2. Standard Agent Skills default to task scope, but the strict resolve_context schema rejected context.task and the compatibility mapper dropped it.

Linear: MCP-9 and MCP-10, both children of MCP-5.

Verification

• RepoFetcherTests: 5/5 passed with warnings as errors
• MCPAgentVisibilityTests: 12/12 passed with warnings as errors
• full Swift suite: 197 tests across 29 suites passed with warnings as errors
• Swift release build passed with warnings as errors
• git diff --check passed

Release plan

After required CI, merge to dev, deploy the exact dev SHA to Development Gateway then Web, redeliver the exact failed central-skills main webhook, activate the six-skill release, run Codex/Claude and package-resource checks, and restart the one-hour soak. Production remains gated by MCP-4 and explicit approval.

[linear-code]

MCP-2

MCP-9

MCP-10