fix(sdk): read MCP verdicts fail-closed; complete the prompt options

[routeplane-ops]

Follow-up to #6, from cross-checking against the Python SDK (routeplane-core/routeplane-python#1). Two real gaps; one reported issue that turned out not to apply here.

1. Verdict reading was fail-open

#6 returned the gateway's body verbatim. That is fine when the gateway answers as documented, and wrong the moment it doesn't:

// gateway returns {} — an empty 200, a proxy error page, a shape we changed
const verdict = await rp.mcp.authorizeToolCall({ server, tool });
if (verdict.outcome === 'deny') return;  // false
makeTheToolCall();                        // proceeds

A default-deny boundary has to survive the client, not just the gateway. Only an explicit outcome: 'allow' | 'deny' is honoured now; anything else denies (and run steps stop) with the unparsed payload preserved under response so the cause is still debuggable. Same fix in the MCP server's shared verdict() helper.

A 4xx carrying no verdict still throws. Axum rejects a malformed body with a plain-text 422; reading that as a policy deny would bury the caller's own bug. Fail-closed applies to reading a decision the gateway actually made — not to inventing one it never sent.

Verified the guard is real rather than tautological: reverting the two normalizers to the old pass-through turns exactly those 12 tests red, and the 422-still-throws case stays green.

2. Prompt options were incomplete

Checked against prompts_api.rs / crates/prompts:

• missing ("error" | "empty", gateway default error) was unreachable — callers could not opt out of a hard failure on an unsupplied variable.
• x-routeplane-cohort had no typed route, so sticky A/B assignment was unusable from PromptResource even though createHeaders already supported the header.
• complete() threaded only model, so temperature, max_tokens, stream and the rest of the flattened chat body were unreachable. Now overrides.
• variables widens from Record<string, string> to any JSON, matching the gateway's BTreeMap<String, Value>.

All additive — existing call sites are unchanged.

3. Not applicable here

The Python SDK was sending provider in the completions body, where the gateway flattens it into a chat request that ignores unknown fields — a silent no-op. TypeScript was already correct, sending x-routeplane-provider as a header. Added a regression test pinning that, plus a doc note on overrides explaining why routing options must not go in the body.

Verification

pnpm build, pnpm test, pnpm lint pass. 77 tests, up from 61: 16 new covering the fail-closed matrix across all four verdict methods, the 422-throws boundary, the payload preservation, and the three prompt-option paths.