MCP auth in Agent Sessions: "Authenticate" notification link is a no-op (targets sessions.html), and the whole auth flow completes silently

- Copilot Chat Extension Version: 0.58.0 (bundled `copilot-chat`)
- VS Code Version: 1.130.0 (1b6a188127eeaf9194f945eb6eb89a657e93c54c)
- OS Version: macOS 26.5.2 (25F84)
- Feature: Agent Sessions + GitHub MCP server authentication
- Selected model: Claude Fable 5
- Logs: observations timestamped below; can provide logs privately

## Summary

When the GitHub MCP server needs (re-)authentication in Agent Sessions, the
user-facing flow gives **zero feedback in either direction** — the notification
action is a dead link, and even a successful sign-in completes without any
confirmation:

1. **The "Authenticate" notification action is a no-op.** Sessions repeatedly
show the notification "The MCP server `GitHub` requires authentication.
[Authenticate]". The action's link target is
`vscode-file://…/vs/sessions/electron-browser/sessions.html` — it points
back into the sessions webview itself, not at an auth flow. Clicking it
dismisses the notification with no visible effect: no browser/OAuth window,
no account picker, no progress, no error.
2. **The Command Palette route is equally silent.** Going through
**MCP: List Servers → (GitHub) → sign in** also completed with **no prompt
and no confirmation** — no toast, no status change visible at the time. The
only way to tell it worked was watching the session's tool inventory
eventually come back.
3. So when auth *does* succeed server-side, the user can't tell. In one session
the GitHub MCP tools flapped (available → removed ×3 → restored over ~7
minutes, 08:45–08:52 local) while other sessions kept showing the
Authenticate notification. Then ~9 minutes later (09:01) the tools dropped
again and the notification returned: a prompt → sign-in → brief reconnect →
drop cycle, with the user blind at every step.

## Steps to reproduce

1. Agent Sessions window with several Copilot CLI sessions using the GitHub
MCP server; let the MCP auth expire or drop.
2. Observe the "requires authentication" notification; click **Authenticate**.
3. Notification dismisses; nothing else happens (link target is
`sessions.html`).
4. Sign in via **MCP: List Servers** instead — completes with no feedback.
5. Watch tools flap back and later drop again, notification returns.

## Expected

- The **Authenticate** action launches (or focuses) the actual auth flow.
- Sign-in — from the notification or the Command Palette — reports its outcome:
progress while running, a success confirmation (or at least the server
status flipping visibly), an error if it failed.
- Sessions stop prompting once auth has succeeded.

## Notes

- The **re-prompting/persistence** half of this looks like #327137 (fixed for
1.131.0, insiders-released; this machine is on 1.130.0 stable) — though the
drop cycle here happened **within one extension-host lifetime**, without a
restart, so it may not be fully covered. Will retest on 1.131 stable. This
issue is scoped to the **feedback gaps**: the dead notification link and the
silent flow, which make the persistence bug (or any auth expiry) needlessly
confusing to diagnose.
- Related (same surface): #327021, #326599, and #327639 (my Agent Sessions sidebar
status-freeze report).