feat: compose authenticated stdio MCP with explicit runtime tool mapping

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e747-8f27-7242-8df8-8bc44f88c929

tools/check_installed_package.py

@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 """Check an installed wheel outside the checkout's import path (use python -I).
 
-Run via: uv run --no-project --with dist/<wheel> python -I tools/check_installed_package.py
+Run via: uv run --no-project --isolated --refresh-package hub-core --with dist/<wheel> python -I tools/check_installed_package.py
 No startup, owner requests, credentials or database connection are needed.
 """
 import json
@@ -9,6 +9,7 @@ from importlib.resources import files
 from pathlib import Path
 
 import hub_core
+from hub_core.mcp.credentials import StdioTokenFile
 from hub_core.conformance import ConformanceHarness
 from hub_core.runtime.app import create_app
 from hub_core.runtime.config import RuntimeSettings
@@ -22,6 +23,7 @@ def main():
     installed = Path(hub_core.__file__).resolve()
     if installed.is_relative_to(checkout):
         raise RuntimeError('package smoke imported checkout instead of installed wheel')
+    StdioTokenFile(Path("/not-read-by-package-check"))
     catalog = json.loads(files('hub_core.security').joinpath('routes.json').read_text())['routes']
     app = create_app(settings=RuntimeSettings(environment='test', access_mode='enforce'))
     routes = [*iter_routes(app), *iter_routes(create_inbox_projection_router())]