MCP `flag_winner`: make an A/B flag's winning variant the default, through makeWinnerDefault #5440

For: closing an A/B test from a harness, with the same guard as the page. makeWinnerDefault (src/actions/flag_winner.ts) accepts only the variant the read-out offers (winnerOffer). It opens the clean-up issue first, so a refusal leaves the flag as it was.

Done:

• [ ] A tool flag_winner { name, winner: "on"|"off" } calls makeWinnerDefault(app, user, name, winner) and answers { name, winner, issue: number, says }. Its refusal is the action's own message.
• [ ] test/mcp-flag-winner.test.ts covers three cases: a flag whose read-out offers "on" is made default, and the issue exists; a winner the read-out does not offer is refused and the flag is unchanged; a non-admin is refused. Each fails without the tool.

Files: src/http/mcp.ts, docs/MCP.md, test/mcp-flag-winner.test.ts. Risk: #5417 (flags) and #5424 (flag_set) sit nearby; any order works.

• [ ] One row in docs/MCP.md, marked as a write in tools/list's annotations as the other writes are.
• [ ] Before pushing, run the new test, test/mcp.test.ts, test/mcp-docs.test.ts and test/mcp-size.test.ts. A red test elsewhere that main also has is named in the pull.

Risk: test/mcp-size.test.ts caps tools/list, so keep the description to one short sentence.