fix: recover Doable MCP authentication in place

[alphali]

Summary

A copied Doable Round could reach the coding agent with the plugin installed but the active MCP connection still unauthenticated. The agent then diagnosed the empty token, changed configuration, and asked the user to restart and paste the request again.

This change preflights the live MCP connection against the exact copied Round and organization before using local state or scanning source. Missing, stale, invalid, and wrong-organization connections now recover inside the original conversation: the agent configures the user-scoped connection, Claude Code asks for only /mcp → reconnect doable, and the original request resumes automatically. Coding-agent-origin feature tests receive the same live preflight before workspace setup or suite lookup.

The plugin release is bumped to 0.2.4, and release verification now locks in the preflight and same-conversation recovery rules.

Privacy and compatibility

Credentials remain owned by the coding-agent host and may be stored only in its user-scoped MCP credential/configuration store. They must not be echoed, passed on a command line, written to the project workspace, or included in Doable payloads. The deterministic helper and MCP/backend contracts are unchanged; get_code_context_connection(round_code=...) already supports the required preflight.

The workflow applies to Codex, Claude Code, and Cursor. Claude Code still requires one interactive /mcp reconnect because an agent cannot invoke its slash-command UI.

Verification

• npm test
• uv run --with pyyaml python ~/.codex/skills/.system/skill-creator/scripts/quick_validate.py for all three Skills
• uv run --with pyyaml python ~/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py plugins/doable-code-context
• No credentials, customer data, private URLs, local paths, or .doable/ state included
• Documentation and manifests updated for 0.2.4

A fresh Claude Code session was not run locally because the Claude CLI is not installed on this host. The release verifier covers the required host behavior, and the existing MCP server contract was checked to accept both round_code and local_workspace_id.