Snider
92727025e7
fix(mcp): transport addr default + progress notifications + auth timing safety
- transport_http.go: addr "" now defaults to 127.0.0.1:9101 per RFC
- pkg/mcp/agentic/dispatch.go: emits NotifyProgress milestones during
validation, workspace prep, queue/slot, spawn, start completion
- pkg/mcp/agentic/watch.go: emits NotifyProgress per watched workspace
completion/failure with running totals
- pkg/mcp/authz.go: restore crypto/subtle for constant-time token
comparison (timing-attack resistance)
- pkg/mcp/registry.go: related touch-up for the auth path
Spark-medium pass. Unused net/http import cleaned after verify.
Co-Authored-By: Virgil <virgil@lethean.io>