test(mcp): pin session concurrency, document error codes, assert id round-trip

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/mcp/jsonrpc.go

@@ -2,12 +2,28 @@ package mcp
 
 import "encoding/json"
 
+// JSON-RPC application-defined error codes (range -32000 to -32099 per spec).
+// Tool handlers return one of these from tools/call to signal a typed failure.
 const (
+	// CodePermissionDenied: caller authenticated but lacks permission for this
+	// resource (e.g. owner not in the allowlist).
 	CodePermissionDenied = -32001
-	CodeNotFound         = -32002
-	CodeConflict         = -32003
-	CodeValidation       = -32004
-	CodeUpstreamGitea    = -32005
+
+	// CodeNotFound: target repo, file, branch, PR, issue, or workflow run does
+	// not exist.
+	CodeNotFound = -32002
+
+	// CodeConflict: write attempted on stale state (branch already exists,
+	// non-fast-forward push, file modified concurrently).
+	CodeConflict = -32003
+
+	// CodeValidation: arguments failed input validation (bad regex, oversized
+	// payload, missing required field).
+	CodeValidation = -32004
+
+	// CodeUpstreamGitea: Gitea API returned an error this server could not map
+	// to one of the codes above. The original status is in error.data.
+	CodeUpstreamGitea = -32005
 )
 
 type Request struct {