mcp: add loopover_file_incident_report tool mirroring POST .../pulls/:number/incident-reports

[JSONbored]

⚠️ Definition of Done: this issue must be completed in full, in a single PR. Do not split this
work across multiple PRs, and do not defer any Deliverable below to a follow-up issue. A PR that
satisfies only some of the Deliverables, stubs a required test, or leaves a checkbox
partially-done does NOT resolve this issue and will be closed.

⚠️ Required pattern: mirror the "build a write-action tool over a POST route" shape of
loopover_file_issue for the write semantics, and ownerRepoPullShape (already used by
loopover_get_pr_maintainer_packet/loopover_get_pr_reviewability) for the owner/repo/pull input.

Context

POST /v1/repos/:owner/:repo/pulls/:number/incident-reports (src/api/routes.ts, #5672) lets a
repo maintainer report that an already-merged rented-loop PR was found harmful. It validates the
body against postMergeIncidentReportSchema, checks the PR exists and is merged, then persists the
report via recordPostMergeIncidentReport (an audit_events row keyed to the PR — no separate
incident table). It requires requireRepoMaintainer and is documented in OpenAPI
(/v1/repos/{owner}/{repo}/pulls/{number}/incident-reports is a registered path).

Its read-side sibling on the same PR already has an MCP tool: GET /v1/repos/:owner/:repo/pulls/:number/maintainer-packet → loopover_get_pr_maintainer_packet. The
write action itself has no MCP tool at all — a maintainer using only the MCP surface cannot file a
post-merge incident report the way they can over REST or the dashboard.

Requirements

• Add a new MCP tool loopover_file_incident_report in src/mcp/server.ts, registered via the
  standard register(...) wrapper (_meta.category from MCP_TOOL_CATEGORIES; use "maintainer").
• Input shape: owner, repo, number (mirror ownerRepoPullShape's owner/repo/pull fields) plus
  the body fields postMergeIncidentReportSchema validates: description, severity, mergedSha.
  Reuse postMergeIncidentReportSchema's field-level validation rather than redefining it loosely.
• Auth: same boundary as the REST route — maintainer-authenticated via the same repo-maintainer
  check the sibling read tools in this class already use.
• Handler: replicate the REST route's exact behavior — look up the PR, 404/error if it doesn't
  exist, error if it isn't merged yet (pull_request_not_merged), then call
  recordPostMergeIncidentReport with reporterKind: "customer" and the calling actor, returning
  the same { ok: true, repoFullName, pullNumber, ...report } shape the REST route returns.
• No OpenAPI/schema regeneration required: the REST route, its request schema
  (postMergeIncidentReportSchema), and its documented OpenAPI path are unchanged — this issue only
  adds an MCP tool wrapper around an existing, already-documented write action.

Deliverables

• loopover_file_incident_report tool registered in src/mcp/server.ts, backed by
  recordPostMergeIncidentReport, reproducing the REST route's validation (PR must exist and be
  merged) and response shape exactly.
• Tool added to MCP_TOOL_CATEGORIES.
• Unit tests covering: happy path, PR-not-found, PR-not-merged, and the maintainer-auth
  rejection path.

All deliverables are required in this one PR — there is no follow-up issue.

Test Coverage Requirements

99%+ Codecov patch target (codecov/patch, unsharded via npm run test:coverage) on every branch
of the new tool handler, including both error paths and the auth-rejection path. Add a regression
test asserting a recorded incident report via the tool is readable back through the existing
loopover_get_agent_audit_feed tool (same audit_events row, same targetKey convention the REST
route's own comment documents).

Expected Outcome

A maintainer-authenticated MCP client can file a post-merge incident report on a harmful rented-loop
PR without falling back to the REST API or dashboard — closing the write-side gap next to the
already-MCP-wrapped PR read surfaces (maintainer-packet, reviewability).

Links & Resources

• src/api/routes.ts: POST /v1/repos/:owner/:repo/pulls/:number/incident-reports (Post-merge incident audit-trail & reporting wiring #5672)
• src/mcp/server.ts: loopover_get_pr_maintainer_packet (input-shape sibling),
  loopover_file_issue (write-tool pattern sibling)
• src/openapi/spec.ts: /v1/repos/{owner}/{repo}/pulls/{number}/incident-reports (already
  registered; do not touch)

[linear-code]

JSO-6453