test(32.1-05): prove MCP call context, both guards, and PRM scopes

- A bare context and a plain request carry no MCP call
- Frontend and backend tool calls record the guard that owns the tool
- PRM uses an advertised scope list and falls back to PRMScopes

modules/pact/mcp_call_negative_test.go

@@ -0,0 +1,30 @@
+package pact
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// TestMCPCallFromBareContext pins D-11: a context that never stored an
+// MCP call answers ok false, including a plain HTTP request.
+func TestMCPCallFromBareContext(t *testing.T) {
+	if _, ok := MCPCallFrom(context.Background()); ok {
+		t.Fatal("MCPCallFrom(context.Background()) ok = true, want false")
+	}
+	req := httptest.NewRequest(http.MethodGet, "http://acme.test/items", nil)
+	if _, ok := MCPCallFrom(req.Context()); ok {
+		t.Fatal("MCPCallFrom on a request that never called WithMCPCall ok = true, want false")
+	}
+}
+
+// TestFrontendTokenScopeLiteralWithoutImplies pins that a composite
+// literal written before Implies existed still compiles and leaves the
+// field empty, so existing declarations stay valid.
+func TestFrontendTokenScopeLiteralWithoutImplies(t *testing.T) {
+	scope := FrontendTokenScope{Name: "servers:read", Label: "Read servers", Description: "List servers."}
+	if scope.Implies != "" {
+		t.Fatalf("Implies = %q, want empty", scope.Implies)
+	}
+}