test: 9 pre-existing test failures in full suite, unrelated to v0.9.7 changes

Start by running the named MCP tests, especially test/mcp/headers.test.ts and test/mcp/httpapi.test.ts, in isolation and in the full bun test suite; inspect the reported header assertions and the release-validation MCP scan tests. Then compare the PostgreSQL and subprocess failures under suitable environment and load conditions. Done means deterministic MCP failures are fixed or their fixtures updated, while environment- or contention-dependent tests are reliably fixed or gated.

Found while running the full bun test suite (12,309 tests) as part of the v0.9.7 release gate.

9 failures, none in files touched by v0.9.7 (verified via git diff v0.9.6..HEAD --stat against each failing test's source and test file — zero overlap):

1. test/mcp/httpapi.test.ts — "serves status endpoint"
2. test/mcp/headers.test.ts — 5 failures: "headers are passed to transports when oauth is enabled", "...when oauth is explicitly disabled", "OAuth is auto-disabled when an explicit Authorization header is present", "OAuth is auto-disabled when Authorization is supplied via headersCommand", "headersCommand overrides a static header that differs only in casing". Reproduces deterministically in isolation (not resource contention) — asserts call.options.requestInit?.headers equals a specific object, gets undefined. Looks like a real bug in MCP transport header wiring, or a test fixture drift — needs investigation, but pre-dates this release (src/mcp/ and test/mcp/ have zero diff between v0.9.6 and v0.9.7).
3. test/release-validation/mcp-datamate-893.test.ts (or its -codex sibling) — "recursive project scan ignores vendored mcp.json files before they can auto-connect"
4. test/altimate/drivers-e2e.test.ts — "PostgreSQL Driver E2E" — beforeEach/afterEach hook timeout. Almost certainly requires a live local Postgres instance not present in this sandboxed environment; likely environment-dependent, not a code bug.
5. test/cli/run/run-process.test.ts — "mid-stream LLM error still exits 0 today (contract lock-in)" — spawns a real opencode run subprocess; timing/resource-contention shaped failure under full-suite parallel load (child_process exit handling in the trace).

Deferred from v0.9.7 because none of these touch this release's diff. Needs triage to split: (a) genuine MCP header-wiring regression [items 2-3, deterministic] vs (b) environment/resource-contention flakes [items 1, 4, 5] that may need environment fixtures or to be marked skipIf(!hasPostgres)-style.

Per this project's own rule against flaky/resource-contention tests, item set (b) especially should either get a real fix or be gated behind an environment check rather than silently failing in CI/full-suite runs.