An agent reads a pull's looks: GET …/pulls/:number/looks and MCP `pull` carry each picture with its width, line and URL #7915

Intent: a look attached to a pull is reachable by an agent, not only by a person on the pull page — today the API and MCP can attach a look (POST …/pulls/:number/looks, MCP attach_look) but nothing reads them back.

Done:

• [ ] GET /api/v1/repos/:owner/:name/pulls/:number/looks answers { items: [{ id, width, says, by, commit, url, at }] }, newest first, from the pull's preview environment (looksForEnv in src/core/looks.ts), with the repository's read access (404 to someone who may not read it), the same url the POST answers (lookUrl)
• [ ] MCP pull carries the same list as looks, and its doc says so; docs/MCP.md regenerated with bun scripts/mcp-tools.ts
• [ ] a pull with no app or no looks answers items: [], not an error
• [ ] tests: a look attached through the POST is listed by the GET and by MCP pull; a reader without access gets 404

Files: src/http/api.ts (beside the POST), src/http/mcp/tools/pull.ts, docs/MCP.md, docs/API (if the route table lives there), tests. Risk: read access must be the repository's, as src/web/pages/looks.ts serves the pictures; never list another app's looks.

Parked by the crew: the check stayed red through 2 automatic tries (pull #8227 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check stayed red through 2 automatic tries (pull #8411 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #8227 closed)
2. the check stayed red through 2 automatic tries (pull #8411 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split by the planner. Both automatic tries went red on the OpenAPI tests (a missing route row, then test/openapi-oa-pull-review.test.ts still asserting the GET was undefined), not on the route itself. The work is now two issues that land separately: #8424 is the GET route with its OpenAPI row and the test assertion updated (the issue names the OpenAPI tests to run before pushing), and #8425 is MCP pull carrying looks, which does not touch api.ts or the contract. #7917 now waits on #8424.