[BUG] ShenyuMcpResponseDecorator reads buffer before super.writeWith, corrupting forwarded body

- severity: High
- files: `shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/response/ShenyuMcpResponseDecorator.java:59-79`
- description: `super.writeWith(Flux.from(body).doOnNext(buffer -> { byte[] bytes = ...; buffer.read(bytes); ... }))` calls `DataBuffer.read(byte[])`, advancing the reader index to the end, before `super.writeWith` writes the buffer. `ServerHttpResponseDecorator.writeWith` writes from the current reader index, so it writes zero bytes — the actual HTTP response body sent downstream is empty.
- impact: The forwarded HTTP response body is lost/empty; downstream receives no body while only the captured future sees the content.
- suggested_fix: Capture bytes via `DataBufferUtils.clone(buffer)` or read a copy without advancing the original buffer; release after writing.
- confidence: Medium
- related_existing: none

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Start at shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/response/ShenyuMcpResponseDecorator.java:59-79 and inspect the writeWith path, especially how the DataBuffer is read before delegation. Verify the fix preserves the forwarded HTTP response body while still allowing the content to be captured, and release buffers correctly after writing.

Written by the indexing model from the issue text.