Add read-only regression coverage for dynamic toolsets and deprecated aliases

Comece pelo registro dinâmico de ferramentas em pkg/github/dynamic_tools.go, pelo mapeamento de aliases obsoletos em pkg/github/deprecated_tool_aliases.go e pela montagem do inventário em internal/ghmcp/server.go. Use os testes de filtragem no nível da requisição em pkg/http/handler_test.go como ponto de entrada. Está concluído quando testes direcionados mostrarem que as ferramentas mutantes habilitadas dinamicamente e os aliases mutantes obsoletos continuam indisponíveis no modo somente leitura.

Read-only guarantees currently depend on implicit inventory behavior that is not regression-tested across dynamic toolset enablement and deprecated alias resolution.

Current behavior is insufficient because the server's read-only contract spans multiple capability surfaces (DynamicTools, inventory filtering, and deprecated alias lookup), but there is no focused test that proves mutating canonical tools and deprecated aliases stay unavailable when read-only mode is active.

Why now: --read-only is a core governance boundary for this server, so the contract should be locked in with explicit regression coverage before toolset and alias work drifts further.

Claim-to-codepath map:

• Dynamic toolset registration in pkg/github/dynamic_tools.go
• Deprecated alias mapping in pkg/github/deprecated_tool_aliases.go
• Server inventory assembly in internal/ghmcp/server.go
• Request-level filtering tests in pkg/http/handler_test.go

Requested behavior:

• Read-only mode should continue to exclude mutating tools when a toolset is enabled dynamically.
• Deprecated aliases for mutating tools should not re-expose write capability under read-only filtering.
• The invariant should be covered by targeted tests.

Evidence Packet

• Commit under test: 1da41fa6947f
• Runtime environment:
  • OS: Darwin 25.3.0 arm64
  • Go: go1.25.7
  • golangci-lint: 2.8.0
• Minimal repro:
  1. Build inventory/server state with read-only mode enabled.
  2. Exercise dynamic toolset enablement and deprecated alias lookup.
  3. Verify whether any mutating capability becomes available.
• Expected behavior: no mutating canonical tool or deprecated alias becomes callable in read-only mode.
• Actual behavior: the code path is not covered by a focused regression test today.

Acceptance Criteria

• Add targeted tests proving read-only behavior holds for dynamic toolsets and deprecated aliases.
• Keep the change scoped to regression coverage unless a concrete behavior bug is found.