[codex] fix MCP auth propagation for streamable tasks

[hengyunabc]

Summary

• add ArthasCommandContext.setSessionAuth to apply authenticated MCP subjects to bound Arthas sessions
• apply the MCP auth subject before streamable async command startup
• copy the transport auth subject into isolated Task sessions
• add regression tests for delegation, streamable call ordering, and isolated task session auth inheritance

Root cause

MCP Bearer authentication was accepted at the HTTP layer, but streamable tools such as trace and watch can run through async task sessions. Those sessions did not consistently inherit the authenticated Subject, so Arthas Job creation failed with command not permitted when password auth was enabled.

Validation

• ./mvnw -pl arthas-mcp-server -Dtest=ArthasCommandContextAuthTest,DefaultCreateTaskContextAuthTest test
• ./mvnw -pl core -am -Dtest=AbstractArthasToolAuthTest -Dsurefire.failIfNoSpecifiedTests=false test
• ./mvnw -pl arthas-mcp-server test
• git diff --check

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.