fix(auth): reject github.io domains in DNS/HTTP token exchange (org namespace takeover)

[SashaMIT]

Summary

• The GitHub token method grants io.github.<org>/* publish rights only to org Owners (active admin membership — github_at.go).
• The DNS/HTTP token methods grant reversed(domain)/* for any proven domain, with no github.io special-casing and an empty BlockedNamespaces list.
• <org>.github.io is served by GitHub Pages from the <org>/<org>.github.io repository. Push access to that one repository — routinely held by ordinary org members, a much weaker bar than Owner — is enough to serve a key at /.well-known/mcp-registry-auth, exchange it for a JWT, and publish under the org's entire io.github.<org>/* namespace.
• Reject github.io (and subdomains) at the shared ValidateDomainAndTimestamp seam used by both DNS and HTTP exchange; io.github.* publishers already have the GitHub method.

Impact if unsolved

Any org member with write access to the org's GitHub Pages repo (or an attacker compromising such a member) can mint MCP packages under the org's trusted namespace — supply-chain poisoning of every downstream user who installs <org>'s servers from the registry, bypassing the deliberate Owner-only gate.

Test plan

• New TestValidateDomainAndTimestampRejectsGitHubPages: rejects my-org.github.io (incl. mixed case and subdomains), still allows lookalikes (github.io.evil-example.com, my-org.github.io.example.com) and ordinary domains.
• Full internal/api/handlers/v0/auth package passes.

Made with Cursor