test(19.7-05): security review pins for the MCP endpoint's outer layers

- TestEndpointGuards: a foreign browser Origin is 403 before the bearer is
  read, a body over the endpoint cap is 413, a long GET stream ends once
  its grant stops verifying (T-19.7-18, T-19.7-19)
- TestDispatch: an argument key the input struct does not declare is
  refused before dispatch (T-19.7-17)
- the gate requires TestEndpointGuards (untagged and tagged) and runs the
  demo's deploy check (T-19.7-37)

scripts/check-phase19.7.sh

@@ -21,7 +21,8 @@
 #              plugin's last commit before the phase).
 #   consumers  the applications at their bumped pins (D-31): go build ./...
 #              and go test -short ./... in each, the demo also with -tags
-#              summercms_mcp and its pin check.
+#              summercms_mcp, its pin check and its deploy check (the nginx
+#              locations of the MCP endpoint).
 #   docker     Docker host only: the Postgres suites by required name in the
 #              framework (cabana), the three plugins and the demo (tagged).
 #   admin      npm --prefix admin run typecheck, the vitest run (the phase's
@@ -94,6 +95,8 @@ GO_TESTS=(
 	# D-30, D-34).
 	./modules/pier:TestToolsList ./modules/pier:TestCatalog ./modules/pier:TestDispatch
 	./modules/pier:TestGuardRules ./modules/pier:TestSessions ./modules/pier:TestFanOut
+	# Plan 05 security review pins (T-19.7-18, T-19.7-19).
+	./modules/pier:TestEndpointGuards
 	./modules/bouncer:TestDispatchMarker ./modules/cabana:TestDispatchMarker
 	./modules/surf:TestStreamingRoute ./modules/surf:TestPierMount
 	./modules/wristband:TestMCPScopes
@@ -106,7 +109,7 @@ GO_TESTS=(
 GO_TAGGED_TESTS=(
 	./modules/pier:TestToolsList ./modules/pier:TestCatalog ./modules/pier:TestDispatch
 	./modules/pier:TestGuardRules ./modules/pier:TestSessions ./modules/pier:TestFanOut
-	./modules/pier:TestPierTracerSmoke ./modules/pier:TestPierStatelessSmoke
+	./modules/pier:TestPierTracerSmoke ./modules/pier:TestPierStatelessSmoke ./modules/pier:TestEndpointGuards
 	./modules/surf:TestPierMount ./modules/surf:TestStreamingRoute ./modules/surf:TestDispatchSmoke
 )
 
@@ -629,6 +632,8 @@ run_consumers() {
 	echo "build: $DEMO_APP (-tags $MCP_TAG)"
 	GO_FLAGS="-tags $MCP_TAG" go_short "$DEMO_APP" ./...
 	demo_pins
+	# T-19.7-37: the demo's vhost opens exactly the MCP paths, unbuffered.
+	(cd "$DEMO_APP" && bash scripts/check-deploy.sh)
 	echo "phase19.7 consumers passed"
 }