Gmail connector: add `gmail.modify` scope so label_thread / unlabel_thread / label_message / unlabel_message actually work

The issue

The Anthropic-hosted Gmail MCP connector (mcp__claude_ai_Gmail__*) exposes label-management tools — label_thread, unlabel_thread, label_message, unlabel_message, create_label, update_label, delete_label — but the OAuth scope bundle the connector requests doesn't include gmail.modify (or gmail.labels). Every call to these tools fails with:

Request had insufficient authentication scopes.

Repro

1. Connect Gmail via claude.ai → Settings → Connectors.
2. From Claude Code (or any Anthropic agent surface using the same connector), call mcp__claude_ai_Gmail__list_labels — succeeds.
3. Call mcp__claude_ai_Gmail__unlabel_thread with a valid threadId and labelId.
4. Result: Request had insufficient authentication scopes.
5. Reauthorizing the connector via the claude.ai UI doesn't fix it — the Google OAuth dialog doesn't surface a label-modify permission because the connector doesn't request one.

Expected

label_thread, unlabel_thread, label_message, unlabel_message, and the label-CRUD tools succeed when called against threads/messages in the connected mailbox.

Why this matters

These tools exist in the connector's tool catalog but are non-functional in practice. The label-management surface is core to how multi-step Gmail workflows (triage, routing, agent-driven label state machines) get built. For our team specifically, we run a small agent workforce that uses Gmail labels (needs-outreach, pipeline-ready-to-send, etc.) as the state mechanism between agents — the scheduled agents can't clean up their own stale state because the connector lacks modify scope. We've been doing it by hand for over a month.

Suggested fix

Add gmail.modify (or more narrowly gmail.labels for label CRUD + gmail.modify for thread-level label mutations) to the OAuth scope set the Gmail connector requests at authorization time. Existing connected users would need to reauthorize once to grant the new scope.

Environment

• Surface: Claude Code (terminal) — same issue would affect Claude.ai chat and any other MCP-consuming surface
• Connector: claude.ai-hosted Gmail (mcp__claude_ai_Gmail__*)
• Account type: Google Workspace
• Verified: yes, by reauthorizing through the connector settings UI; the Google permissions dialog presented no label/modify permission to approve