Enforce fail-closed startup when PAT/OAuth scope requirements are unmet

Problem
Insufficient scopes can lead to confusing partial functionality instead of explicit blocking.

Why now
Permission-scoped operation is a core safety expectation for the GitHub MCP server.

Current behavior is insufficient
Scope problems can surface late at tool-call time and appear as sporadic failures.

Expected behavior
At startup (or deterministic preflight), fail closed when required scope requirements for configured toolsets are unmet.

Acceptance criteria
- Deterministic scope validation result before normal operation.
- Explicit classification for scope/policy failures.
- Clear remediation guidance in machine-readable + human-readable error output.

Validation
- Add tests for scope-deficient and scope-sufficient configurations.
- Verify deterministic error class and output shape.

Codepaths
- `pkg/scopes`
- `pkg/http/oauth`
- `cmd/github-mcp-server`

Trace scope handling in pkg/scopes and pkg/http/oauth, then follow startup wiring from cmd/github-mcp-server. Add coverage for scope-deficient and scope-sufficient configurations, and verify that validation is deterministic before normal operation. Done means scope or policy failures have a stable classification plus machine-readable and human-readable remediation guidance.

Written by the indexing model from the issue text.