Flaky MCP authorization repeated-initial-control test returns OK

[jbeda]

CI flake: repeated MCP authorization initial control returns OK

The race job for PR #2075 failed in internal/adapter/server on an unrelated, intermittently failing server test:

• CI run: https://github.com/stacklok/mecatl/actions/runs/37245098961/job/111561341816
• TestMCPAuthorizationGRPCRejectsRepeatedInitialControl (internal/adapter/server/mcp_authorization_transport_test.go:589): repeated initial control code = OK, want InvalidArgument.
• Reproduced locally on the same branch: go test -race ./internal/adapter/server -run '^TestMCPAuthorizationGRPCRejectsRepeatedInitialControl$' -count=200 fails intermittently with the same assertion (the 200 repetitions completed in under a second).

The test sends two initial frames. RecheckMcpAuthorization validates a repeated initial frame at internal/adapter/server/grpc.go:1709, but relayMCPAuthorizationControl reads subsequent controls in a goroutine while independently draining the continuation's events (grpc.go:1807-1898). If the continuation closes before the receive goroutine's error reaches controlDone, the relay exits on events == nil and returns nil (OK). Depending on scheduling, the same invalid frame instead returns InvalidArgument. Please pin the desired stream/terminal ordering and make the control validation/relay deterministic without changing the rule that control-stream errors must not cancel a healthy continuation.

The four Redis connection refused log messages shown later in the CI job are not this failure: the package records the assertion above, and TestStorageReadyRedis deliberately closes miniredis while checking degraded readiness (internal/adapter/server/drain_test.go:248-279). They should not be used to diagnose this test failure.

Acceptance

• Repeated initial control deterministically returns InvalidArgument under race and repeated runs (or explicitly revise the protocol/test if a terminal continuation is allowed to win).
• Preserve the transport-fault/continuation-lifecycle guarantees in adjacent authorization tests.
• Verify with the focused repeated race test and the server package race suite.