fix: request JSON from OAuth token endpoints

[Aaronontheweb]

Summary

• Add Accept: application/json only to form-encoded OAuth token requests.
• Extend the in-process OAuth MCP fake with response-format negotiation.
• Update the release notes and the operations skill.

Part of #2141. This PR covers token-response negotiation only. It does not add static client-secret configuration.

Target release: 0.27.0-beta.4.

Spike: https://github.com/Aaronontheweb/mcp-github-oauth-spike

Verification

• The new integration test failed before the production change.
• 8 focused HTTP handler tests passed.
• 24 focused OAuth integration tests passed.
• The full solution passed 8,441 tests and skipped 21 platform or opt-in tests.
• The Release build completed with zero errors and one existing ASPIRE010 warning.
• Changed-file format verification passed.
• Header verification passed.
• Slopwatch found zero new issues.
• Behavioral evals could not run because the required NETCLAW_EVAL provider settings are absent.

[Aaronontheweb]

The approach is sound. I found no defect in the changed code at revision 3dcf939d.

The handler adds Accept: application/json only to POST requests with form content. MCP JSON-RPC requests stay unchanged.

The programmable server returns form data without that header. The integration test proves that the production manager completes authorization with the header.

All code and platform checks passed. The required screenshot check remains red.

The first screenshot run found an unrelated MCP permissions-grid difference. The retry failed before execution because its attempt-specific binary artifact did not exist.

The stacked #2169 branch passed the same screenshot suite with this commit. This evidence points to the smoke workflow, not this OAuth change.

The PR needs a successful required check before merge. I did not perform a live GitHub authorization-code exchange.

[Aaronontheweb]

LGTM