#2056 Request all advertised OAuth scopes; keep sync verdicts visible

Why

Scope discovery capped the authorize request at 100 scopes. PostHog's MCP resource now advertises 150, so the last 50 were dropped, including the ones its server needs to start a session. Every PostHog MCP connection created through the CIMD client since late August minted a token the server rejects with 401, and synced zero tools.

The credential-only health check then overwrote the sync-stamped rejection with "healthy", so the UI showed a green badge and no tools.

What

• Bound discovered scopes by joined scope-string length (8 KiB) instead of a count of 100.
• Sync-supplied verdicts carry reason: tool_sync_failed; isToolSyncHealth recognises the reason as well as the detail prefix.
• A health check without a probe serves an existing sync verdict instead of replacing it with healthy, and never persists over one.

Tests

• Scope union: 150 realistic scopes are all requested; a 2000-scope list is cut at the budget.
• OAuth flow: a sync-stamped expired verdict survives a credential-only health check. Fails without the fix.

After deploy, affected users need to reconnect PostHog once to mint a full-scope token.

🤖 Generated with Claude Code