Review fixes for SEP-2468 iss scenarios (stacks on #220)

[pcarleton]

Stacked on modelcontextprotocol#220 — review fixes for the SEP-2468 iss parameter scenarios. One commit per finding so you can take or leave each independently; merge this into feat/iss-parameter-conformance (or cherry-pick) and it'll flow through to modelcontextprotocol#220.

Commits

1. fix: createAuthServer iss option type/guard and NotAdvertised scenario duplication — kept the on-by-default behavior (mock AS models a well-behaved server) but issParameterSupported is now boolean | null so callers can pass null to omit the metadata field, matching the codeChallengeMethodsSupported pattern. The !== undefined guard at L155 was unreachable with a = true destructure default, so there was no way to omit — and IssParameterNotAdvertisedScenario was silently advertising support (a duplicate of IssParameterSupported). It and IssParameterUnexpected now pass null/'omit' explicitly. Doc comments updated to match.
2. fix: rejection scenarios silently pass when client never reaches auth endpoint — correctlyRejected = !tokenRequestMade reported SUCCESS on a setup failure. Now gated on authReached.
3. fix: iss-unexpected scenario contradicts SEP-2468 spec table row 3 — spec says absent + iss present → Compare, not reject. Scenario sent a correct iss and FAILed compliant clients for proceeding. Now sends a mismatched iss so rejection is the spec-required outcome; reference client updated to compare-when-present.
4. refactor: replace harness-config checks with client-proceeded checks — iss-advertised-in-metadata etc. fired in onAuthorizationRequest and asserted only that the harness was configured correctly. Replaced with one check per positive scenario keyed on tokenRequestMade.
5. refactor: rename check IDs to sep-2468-* — aligned with the spec table rows; auth/iss-supported and auth/iss-wrong-issuer now share sep-2468-client-compare-iss-supported.
6. feat: add sep-2468.yaml requirement traceability — 8 check: rows, 1 excluded:.

Coverage after this stack

sep-2468.yaml check:	covered by	status
client-compare-iss-supported	auth/iss-supported, auth/iss-wrong-issuer	✅
client-reject-missing-iss	auth/iss-supported-missing	✅
client-compare-iss-unadvertised	auth/iss-unexpected	✅
client-proceed-no-iss	auth/iss-not-advertised	✅
client-validate-metadata-issuer	—	gap (host candidate: client/auth/discovery-metadata.ts)
client-no-normalization	—	gap
as-include-iss	—	gap (AS suite, ok to defer)
as-advertise-iss-supported	—	gap (AS suite, ok to defer)

Left as prose (not in this stack)

• Rebase onto main — feat: add conformance tests for iss parameter (SEP-2468) modelcontextprotocol/conformance#220 predates refactor: range-based spec version tagging (introducedIn/removedIn) modelcontextprotocol/conformance#265 (source: { introducedIn } replaces specVersions) and feat: add new-sep scaffolding command modelcontextprotocol/conformance#272 (src/seps/ directory). After rebase the specVersions: ['draft'] lines in issuer-parameter.ts will need to become source: { introducedIn: DRAFT_PROTOCOL_VERSION }. The sep-2468.yaml in this stack lands in a directory that only exists post-rebase.
• auth-test-iss-validation.ts — we're working towards deleting these examples from this repo and preferring linking to WIP branches for testing, or released sdk versions, and just making that linking flow easier. i left this in here for now, but will aim to delete with the bigger deletion.
• Coverage gaps above — fine as follow-ups; the four table-row checks are the core of SEP-2468.

npx vitest run src/scenarios/client/auth/index.test.ts → 35/35 pass on this stack.