fix(e2e): add --allow-read to MCP deno runner (unblocks 3 MCP tests)

mcp-bridge/main.js imports nickel-validator.js, which does an
`existsSync(...)` on the .ncl contract file. That requires Deno
read permission. The shebang in main.js correctly lists
`--allow-read`, but `deno run <file>` ignores shebangs — only the
flags on the CLI invocation matter.

Reproduced locally:

    $ echo '{"jsonrpc":"2.0","id":1,"method":"initialize",...}' \
        | deno run --allow-net --allow-env mcp-bridge/main.js
    error: Uncaught (in promise) NotCapable: Requires read access to
    "/.../cartridges/local-coord-mcp/schemas/coord-messages-contracts.ncl"

Adding --allow-read to MCP_RUNNER. Fixes 3 of the 17 E2E feature
failures surfaced once my setup-beam fix got the server actually
running:

  - MCP initialize          (was: expected '"result"', got '{}')
  - MCP tools/list          (was: expected '"tools"', got '{}')
  - MCP tools/call boj_health (was: expected '"result"', got '{}')

The remaining 14 failures (feedback/order paths) are a test-vs-router
mismatch — the test calls e.g. `POST /cartridges/feedback-mcp/load`
but the router only exposes `POST /cartridge/:name/invoke`
(singular, no `/load` step — cartridges auto-load via Catalog). That
needs real product-side work: either add the missing routes
(`/cartridges/:name/load`, `/cartridges/:name/invoke`, `/order`) or
rewrite tests to use existing routes. Filing as a separate concern;
out of scope for this baseline-CI-rot PR.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

tests/e2e_full.sh

@@ -110,10 +110,15 @@ if ! command -v jq &>/dev/null; then
 fi
 green "  curl + jq available"
 
-# Check for node or deno (MCP bridge)
+# Check for node or deno (MCP bridge).
+# mcp-bridge/main.js requires --allow-read for nickel-validator.js (loads
+# .ncl contracts) — the shebang says so, but `deno run <file>` ignores
+# the shebang and uses only the flags passed to the CLI invocation.
+# Without --allow-read, the bridge crashes on import with NotCapable
+# and the test sees empty stdout (saw on PR #150 CI 2026-05-25).
 MCP_RUNNER=""
 if command -v deno &>/dev/null; then
-    MCP_RUNNER="deno run --allow-net --allow-env"
+    MCP_RUNNER="deno run --allow-net --allow-env --allow-read"
 elif command -v node &>/dev/null; then
     MCP_RUNNER="node"
 fi