[gustmrg]

An audit of the MCP and tool-policy tests listed every test next to the behavior it protects. Two tests protected nothing another test does not, so they are removed. A first version of this PR removed two more, but breaking the code they cover showed each was the only test catching a real bug, so they stay. Nothing else changes.

• tests/mcp-bridge.test.ts: removed "returns needs_sign_in for an unauthorized oauth server without opening a browser". Its fixture (provider: {}) cannot open a browser, so its title's promise is only asserted by "never opens a browser for background OAuth connections".
• tests/tool-authorization-broker.test.ts: removed "stores a blocked MCP tool call as an integration rule". Giving integration_call blocks the wrong scope in blockCategory still fails two kept tests.
• tests/mcp-service.test.ts: renamed "discards sign-in results when the connection changed during the flow" to "says the connection changed when that interrupts its sign-in before it reaches the server". It does not reach the commit re-check: it is the only test of signInFailure naming the change instead of reporting a bare cancellation.
• tests/mcp-service.test.ts: kept "discards credentials exchanged for a connection that was removed before they were committed". It is the only test of the not_found branch at commit, and of a removed connection's credentials being deleted when remove() fails to do it.

Testing

• npm run lint: clean (two pre-existing warnings in src/components/storage-*.tsx, untouched).
• npm run format:check, npm run typecheck (all four tsconfigs), and npm run build: clean.
• npm test on Node 22: 2437 passed. The earlier note about 19 failures from this machine's SSH keys was wrong: they appear only on Node 26, and the three SSH test files pass on Node 22.
• Each removal was checked by breaking the code it covers and running the tests left; each kept test above was checked the same way.
• Built app: not checked; the change touches no production code.

Not in this PR

Two gaps this audit found are covered in a separate PR, test(mcp): cover revoking access and deleting secrets for a connection.