fix: require explicit scope for GitOps agent deletion

[cursor]

Description

GitOps agent DELETE paths use raw, non-scope-prefixed identifiers, and the backend selects account/org/project scope from query parameters. The new delete operation allowed resource_scope to be omitted and even showed a project-level example without it, which sent an account-scoped DELETE. When the same raw ID existed at multiple scopes, this could delete the wrong agent.

Require an explicit resource_scope for gitops_agent deletion, correct all examples, and add registry/public-tool regressions proving omission fails before HTTP dispatch and explicit account/project scopes produce the correct query parameters.

Validation: focused regressions (16 tests), complete GitOps/tool-handler suites (248 tests), full pnpm test (117 files / 2557 tests), pnpm typecheck, pnpm build, pnpm standards:check, pnpm docs:check, and git diff --check HEAD.

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation
• Other

Checklist

• pnpm test passes
• pnpm typecheck passes
• pnpm build passes
• pnpm standards:check passes (architecture guardrails — see docs/coding-standards.md)
• pnpm docs:check passes (if registry/tool counts changed)

Coding Standards (registry-driven MCP model)

If this PR adds or changes Harness API coverage:

• No new server.registerTool() calls — only toolset definitions in src/registry/toolsets/
• Toolset registered in ALL_TOOLSETS and ToolsetName union
• operationPolicy on every new/changed endpoint
• Shared response extractors from src/registry/extractors.ts (no raw passthrough on real endpoints)
• identifierFields and scope declared on new resources
• No console.log() in src/ (stdio JSON-RPC safety)

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}