types(mcp): type the CLI's parameterised API calls from the published document (#9773)

The second tranche. #9521 built the typed accessors; its scanner rejected any template containing an
interpolation, so every per-repo and per-contributor call -- the majority of the CLI -- missed the
typed overload and read its payload as `any`. The document already described most of them.

Three things had to change for a composed call to resolve.

The path builders now DECLARE their shape. `toolRepoBase` returned `string`, which erases the path
at the type level, so `apiGet(`${toolRepoBase(o, r)}/settings`)` could never match anything; it and
the 24 locally-built bases now carry template-literal types. That is also what lets the generator's
scanner resolve them: it reads the same declarations the type checker does, so the two cannot
disagree about what a base is.

The tables are keyed by METHOD, not by path. `/v1/repos/{owner}/{repo}/agent/pending-actions` lists
on GET and proposes on POST, and those return different shapes -- a path-keyed table had to guess,
and the first version of this guessed `post`, handing the GET call site the POST response type. The
CLI's own `payload.pendingActions` read is what contradicted it, the moment a schema was attached at
all. Caught by the type checker before it shipped.

And the generated copy now carries what a copied schema REFERENCES. `closure` followed only
`*Schema` names, so a schema depending on a plain value beside it (`AGENT_ACTION_CLASS_VALUES`)
emitted a file that would not compile. Values declared in the source are copied; anything else is
imported from the contract's limits.ts, where it is restated and pinned -- and a bound missing there
fails the contract build rather than emitting something broken.

30 parameterised calls are typed now, up from 8, and the guards are in mcp-api-client.test.ts:
method disambiguation, base-path resolution, the copied-value closure, and the prose false-positive
the first cut of the constant scanner hit (it emitted imports for DELETE, REQUIRED and REST, read
out of doc comments).

Still `any` at the fallback overload, for the endpoints whose 200 the document does not describe
with a named schema. Flipping that to `unknown` leaves 72 narrowing sites, and the honest fix for
them is to describe those endpoints -- #9773 stays open for it.

Author: JSONbored