[BUG] Cowork mode never requests user:mcp_servers OAuth scope — Claude.ai connectors (GitHub etc.) permanently blocked

Summary

Cowork mode fails to load any Claude.ai MCP connectors (GitHub, etc.) because the OAuth token only contains user:inference scope. The user:mcp_servers scope is never requested during the Cowork authentication flow, so re-authenticating does not fix it.

Debug log evidence

Every Cowork session startup shows:

[claudeai-mcp] Gate returned: true
[claudeai-mcp] Missing user:mcp_servers scope (scopes=user:inference)

The gate (tengu_claudeai_mcp_connectors) is enabled in .claude.json, so this is not a feature flag issue. The OAuth token itself is the problem — it never includes user:mcp_servers.

Steps to reproduce

1. Add any Claude.ai connector (e.g. GitHub) via claude.ai/settings
2. 2. Open a Cowork session
3. 3. Check debug log at mnt/.claude/debug/<session>.txt
4. 4. Observe: gate=true but scope missing on every startup
5. 5. Log out and back in — problem persists (re-auth never requests the missing scope)

Expected behavior

Cowork OAuth flow requests user:mcp_servers scope so Claude.ai connectors are available in sessions.

Actual behavior

Token only ever has user:inference. Re-auth does not help. Connectors never load regardless of how many times you reconnect.

Environment

• Platform: Cowork (macOS)
• - .claude.json confirms: "tengu_claudeai_mcp_connectors": true

Related

• #21874 — similar symptom (MCPs not showing) but different root cause (flag resetting). Our flag is on; the scope is just never requested.