[BUG] Desktop: same-URL plugin MCP dedup keeps the unauthenticatable Engineering `github` server and hides the working official GitHub plugin

Summary

Two installed plugins define an MCP server with the same URL, https://api.githubcopilot.com/mcp/:

• Engineering plugin (desktop): github server, type: http, no headers (OAuth only)
• github@claude-plugins-official: github server, type: http, Authorization: Bearer ${GITHUB_PERSONAL_ACCESS_TOKEN}

GITHUB_PERSONAL_ACCESS_TOKEN is set in the user environment and is visible to the session process. Even so, only plugin:engineering:github is loaded, and it stays in needs_auth indefinitely. plugin:github:github never appears in the session's server list.

The Engineering server also can't be authenticated from the desktop app: it doesn't appear in any sign-in UI, so it is stuck in needs_auth with no way out.

Steps to reproduce

1. Windows 11, Claude desktop app (Code tab), Engineering plugin enabled.
2. Install and enable github@claude-plugins-official (user scope).
3. Set GITHUB_PERSONAL_ACCESS_TOKEN as a user environment variable and fully restart the app.
4. Open a session and check the connector status.

Actual: plugin:engineering:github shows needs_auth, and no plugin:github:github server or tools are available.

Workaround: disable the Engineering plugin and restart. plugin:github:github then loads and works immediately (get_me succeeds).

Expected

• When deduplicating same-URL servers, prefer the one that can authenticate (for example, one with configured headers or credentials) over an OAuth-only one that isn't signed in, or
• surface the conflict and let the user choose, and
• make plugin OAuth servers in needs_auth signable from the desktop app.

Related

• #91847: same class of bug (same-URL dedup picks a server that cannot authenticate), headless variant
• #94321: plugin MCP OAuth in desktop sessions can't authenticate