fix(mcp): dynamic skill tools run as authenticated key principal

[maxmad64bis]

⚠️ base-red inherited: #15306

Summary

A dynamic skill call ran as whatever session id the client sent, so a keyless client could run a skill under another tenant's identity. The handler now runs each dynamic skill tool as the authenticated key principal, the same rule the static skill tools and memory tools already use, and a keyless call still runs as mcp.

Related Issues

• No linked issue — reproduced on the release base

Target Branch

• Base is the active release/v3.8.x branch (the highest open release/v*), not main
• New feature? From 3.8.55 on it is held with the v4-feature label for the v4 channel

Validation

• Change type: other
• Focused tests and category gates from the golden path — inherited: 1 red test file(s) among those touched also fail on the release base (see the banner above)
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/unit/mcp-dynamic-skill-owner.test.ts — covers the three gate cases: a key with another tenant's session id, a keyless call with a session id, and a second key with the first tenant's session id.

Coverage Notes

• open-sse/mcp-server/server.ts — covered by tests/unit/mcp-dynamic-skill-owner.test.ts, and tests/unit/mcp-public-error-boundaries.test.ts still runs green through the same handler.
• tests/unit/mcp-dynamic-skill-owner.test.ts — new test for the owner rule itself.
• the fix(mcp) changelog fragment — no code to cover.

Reviewer Notes

• Behavior: a call without a key now runs as mcp even when it sends a session id (before, it ran as that session id); calls with a key run as before.