Restrict built-in OAuth apps to explicitly allowed integrations

[RayTCosgrove]

GitHub MCP can select the cloud first-party:github app because it shares github.com OAuth endpoints with GitHub REST. That app uses GitHub App user tokens with fixed permissions and repository installation access; selecting it does not grant the classic OAuth scopes an integration may expect. Today the SDK also accepts that client/integration pairing directly through oauth.start.

Add an optional allowedIntegrations policy and restrict the cloud GitHub App to github_rest, the integration currently named in its registration. The existing integrations field remains a ranking hint, preserving host matching for other deployments and providers.

• Exclude disallowed apps from every picker tier and expose the policy in the HTTP client listing.
• Reject unsupported integrations before scope discovery, provider requests, or session creation; recheck at callback completion if host policy changes during authorization.
• Omitted policies preserve existing behavior; an empty policy denies all new authorizations. Existing credentials and refresh resolution remain unchanged. New connections and reconnects for custom GitHub slugs require an explicit allow-list entry or a separately registered OAuth app.

This is a guard against selecting an unsupported shared app. It does not grant private repository access or repair existing GitHub App installations. Supporting GitHub MCP through this app still requires configuring and approving its repository permissions and installation access, then expanding the allow-list. GitHub documents the user-token permission limits here.

Validation: 116 focused tests pass (79 SDK OAuth flow/scope tests, 31 picker tests, 6 cloud configuration tests). The two targeted cloud e2e scenarios pass: the supported REST flow still redirects, and a different integration sharing GitHub's endpoints is rejected by the API and offers Register app in the browser. Full typecheck passes across 45 packages; lint and format:check pass. The full test gate stopped on two 15-second MCP test timeouts; both files passed on a separate run with two workers (15 tests). The entire unit suite has not completed successfully, so this remains a draft.

Browser evidence uses a fresh synthetic workspace and no production credentials: