MCP `approve_here`: a writer lets an origin fork's pull run here, its check and preview starting at its current head #5004

Done: MCP approve_here { repo, number } approves an origin fork's pull at its current head so its check and preview start, through the same action the API uses (approveToRun, POST …/pulls/:number/approve-here), so its rules, refusals and access are exactly the route's — no second implementation.

• [ ] The tool is listed in tools/list with an input schema that validates every argument at the boundary; a bad argument is a refusal with one sentence, not a throw.
• [ ] The answer is JSON with a says sentence, like the tools beside it.
• [ ] A row in docs/MCP.md's tool table.
• [ ] Tests: a writer succeeds, a reader, an agent or a stranger is refused as the route refuses them, and a bad argument is refused. An agent's token is refused as the route refuses it, and the approval names the head it approved, so a later push needs approving again.

Files: src/http/mcp.ts, docs/MCP.md, one new test file. Risk: mcp.ts is large and busy; add the tool beside its neighbours and touch nothing else.

Parked by the crew: the check failed ("the merge queue > ten green pulls: a candidate carries eight, the next the other two, and the log says each gate (#3430)") and the decider saw no point in another try (pull #5016 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("origin sync: incremental, event-shaped, and polite > a conditional request is answered from the cache, not refetched") and the decider saw no point in another try (pull #5122 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("the merge queue > ten green pulls: a candidate carries eight, the next the other two, and the log says each gate (#3430)") and the decider saw no point in another try (pull #5016 closed)
2. the check failed ("origin sync: incremental, event-shaped, and polite > a conditional request is answered from the cache, not refetched") and the decider saw no point in another try (pull #5122 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Replaced by #5214: same scope, but it waits for fixes to the two unrelated tests that failed its tries (#5129, #5201).

Closed as dropped, not split: the forge refused a one-for-one split here. Nothing is lost. #5214 carries this scope word for word, under the same pillar, and waits for the fixes to the unrelated red tests.