The flags a forge admin sees on /settings/flags are one plain-data read: name, why, default, owning issue, live value #7017

First half of #5417, split so the read and its rules land apart from the MCP tool list, which every MCP pull crowds.

Done:

• [ ] A new src/actions/flags_view.ts exports readFlags(app, user). It answers each flag in flagRegistry() (src/core/flags.ts) as plain data: name, why, default, the issue that owns removing it, and the live value. It sits behind mayManageFlags, so anyone else gets the refusal the page uses.
• [ ] A new test declares a flag with useFlagRegistry (the built-in FLAGS is empty on main). An admin sees it with its default, and after the value is set the live value changes. A non-admin and an agent are refused.
• [ ] Nothing else changes: the page and MCP keep their current code for now.

Files: src/actions/flags_view.ts, test/flags-view.test.ts

If the test finds the behaviour wrong, fix the handler it names in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.