fix(19.7): RA-IN-05 a token whose scopes no longer resolve gets its own error

The built-in backend guard's principal answers errScopeUnavailable, not a
nil principal, when an admin personal token's stored scopes all fail to
resolve (a scope's plugin was removed). MCPDispatch passes it through and
dispatch maps it to the fixed tool error "pier: the token's scopes no longer
grant this route" instead of claiming the administrator's account is
unknown or deactivated; the listing check still treats it as a refusal, not
as a failed check.

modules/pier/dispatch.go

@@ -183,6 +183,8 @@ func (d *dispatcher) run(ctx context.Context, id Identity, info callInfo, t *too
 			return toolError(tokenInvalid), 0
 		case errors.Is(err, errSubjectUnavailable):
 			return toolError(errSubjectUnavailable.Error()), 0
+		case errors.Is(err, errScopeUnavailable):
+			return toolError(errScopeUnavailable.Error()), 0
 		}
 		logger().Warn("pier: guard dispatch failed", "tool", t.name, "guard", t.guardName, "error", err)
 		return toolError(dispatchFailed), 0