Triage the open PR backlog

[cliffhall]

Part of the triage tracker #4875. Blocked by #4857 (2026-07-28 Spec Refactor) and #4858 (agentic software factory). The shared conventions (close labels, close notes, throttling) are in #4875.

Goal

Triage every open PR: about 317 as of 2026-09-26. Each one ends up either carried forward (ported to the refactored code, or used as the reference for a tracked issue) or closed with a labelled note. Modeled on inspector#1819.

Why this comes after the refactor

Almost every open PR targets main and the pre-refactor code: SDK v1 APIs and the 2025-era protocol. Once #4857 lands, most of them no longer apply cleanly. Triage then asks "is the idea still wanted on the new code?", not "does this diff merge?".

Buckets

1. Server submissions and README listing PRs: close as out of scope and point to the MCP Registry.
2. PRs against archived servers: close and point to servers-archived.
3. Superseded by the refactor: the change is already covered by Tracker: 2026-07-28 Spec Refactor #4857 (e.g. SDK bumps, v2 ports such as fix(fetch): port to mcp SDK v2 #4565 and feat: MCP v2 (draft) #4452), or the code no longer exists. Close with thanks. Where a PR was used as a reference, credit it.
4. Still valuable: a real bug fix or an in-scope enhancement. Don't merge the stale diff. Open or link a v2 issue on the board that references the PR as the reference implementation, and credit the author. Then close the PR with a note pointing to that issue, or ask the author to rebase onto v2/main, depending on the contribution policy set in Tracker: Agentic software factory (AGENTS.md, skills, quality gates, v2/main release flow) #4858.
5. Dependency and automation PRs (e.g. Dependabot): close if superseded by the refactor's dependency set or the factory's dependency sweeps.
6. Security-weakening proposals: close with the security-declined label, in addition to the main close label, using the Inspector's three-condition test adapted to these servers. Never apply it to a PR that fixes a vulnerability; those get handled as security fixes.

Tasks

• Take a full snapshot of open PRs (gh pr list --state open --limit 1000 --json …) and record the counts per bucket in a comment here before closing anything.
• Create the shared close labels, if the issue pass hasn't already.
• Finalize the close notes, one per bucket. Each one references Tracker: Triage the open issue and PR backlog #4875 in the original comment.
• Hand-review buckets 4 and 6 before closing anything in bulk.
• Run the scripted, throttled closes. Don't lock threads, so authors can reply.
• Post a final summary here: counts per label, and the list of PRs carried forward as issues.

Acceptance criteria

• No open PR predates the refactor unless it was deliberately kept, with the reason recorded here.
• Every closed PR carries a close label and a note that references Tracker: Triage the open issue and PR backlog #4875.