The agent scope preflight now mirrors cmd/event's scopeRemediationHint for both
identities, replacing the bespoke replacement-era hint:
- user: the re-auth hint lists ONLY the missing scopes (the open platform
authorizes incrementally, so re-login with just the missing keeps existing
grants — no merge needed). Uses the canonical repo-wide `auth login --scope`
phrasing instead of a one-off Chinese string.
- bot: previously skipped entirely; now checks the app's published TenantScopes
(fetched best-effort via appmeta.FetchCurrentPublished behind a swappable seam;
a fetch failure downgrades to a no-op). A missing scope reports the
developer-console re-publish remediation (the event-style scan-to-enable deep
link lives in cmd/event and is not duplicated here).
preflightScopesForRef keeps its signature (no call-site changes); bot fetch uses
a bounded background context so no ctx param is threaded. Tests cover the
incremental user hint, the bot missing/present/no-scopes branches, and the bot
seam wiring.
a1c3530ec9