Fix silent MCP-server initialize-crash + contact-link regression + source=mcp telemetry

[milstan]

Summary

• Silent initialize-handshake crash. resolveClientFromEnv() and the missing-LEADBAY_TOKEN handler both process.exit(1)'d before server.connect() ran, killing the MCP stdio process mid-JSON-RPC handshake (host showed bare "Server disconnected" with no stderr captured). Replaced both exits with a BrokenLeadbayClient sentinel whose every request method rejects with a pre-baked LeadbayError (AUTH_MISSING / AUTH_EXPIRED); the server now answers initialize + tools/list and the auth failure surfaces on first tool call. Added an early uncaughtException / unhandledRejection safety net so future startup crashes leave a real stack on stderr + Sentry, plus a new mcp.startup PostHog event keyed on auth_state ∈ {ok,missing,expired,probe_failed} for bucketing disconnect reports. runDoctor() keeps its interactive hard-exit.
• Contact-name link regression (post-0.9.0). The agent started rendering plain-text contact names on rows whose linkedin_page was null because linking/contact-linkedin.md's "When … link … Otherwise fall back …" framing read as a two-option choice. Rewrote the snippet with a leading MANDATORY directive (every contact name MUST be wrapped in markdown link syntax; the search URL is always constructable from name + company), tightened pull-leads-table Column 3, and replaced followups-map's inline priority duplicate with {{include:linking/contact-linkedin}}. New deterministic audit packages/mcp/test/audit/contact-link-invariant.test.ts asserts the mandate exists in the snippet AND lands in every contact-rendering tool description — any softening, removed include, or new contact-rendering tool added without the rule trips the audit.
• source: "mcp" telemetry tagging. baseProps() now stamps every captured PostHog event with source: "mcp"; Sentry initialScope.tags carries the same tag so exceptions are bucketed at the surface level. New regression test exercises tool-call / quota-hit / topup-link / startup events in one session and asserts the tag lands on all four.

Test plan

• pnpm -r typecheck clean across all 5 packages
• pnpm -r test — 491 tests passing (260 core + 12 leadclaw + 203 mcp + 16 promptforge)
• New audit (contact-link-invariant) and new telemetry regression (every captured event type carries source=mcp) green
• Server-test regression for the silent-initialize-crash fix passes — broken-client returned on missing-token and AUTH_EXPIRED paths instead of process.exit(1)
• Smoke: with a bad token + no region pinned, start the MCP server and confirm Claude Desktop reports it as connected, lists tools, and calling leadbay_account_status returns a clear AUTH envelope (vs the previous "Server disconnected")
• PostHog dashboard: confirm new events carry source=mcp and mcp.startup events show up with the four auth_state buckets

🤖 Generated with Claude Code