xint-mcp-tier-must-match-credential-phase

xint’s MCP server must register OAuth-gated tools (engagement, analytics, write operations) in a separate ‘engagement’ tier policy, not in the read_only tier. Registering all tools under read_only silently blocks Phase 2b commands. The MCP registration policy tier must be updated when Phase 2b credentials are activated — it cannot be pre-registered at the read_only level.