Refuse service without active applicable policy and required scope wiring

Problem/Motivation

MCP Sentinel currently detects incomplete scope/profile wiring, but released setup paths can leave OAuth enforcement disabled and treat missing scopes as permissive. A governed endpoint can therefore remain available without an applicable active policy or the enforcement wiring needed to apply it. The prior warning-only lineage does not establish a fail-closed product boundary.

Proposed resolution

Make governed operation refuse service when any required source-governance prerequisite is missing:

• MCP Sentinel is unavailable or disabled;
• no active policy/profile applies to the request and target;
• required scope enforcement is disabled or required scopes are absent;
• required write, decision, or evidence enforcement wiring is incomplete.

Local policy remains authoritative and may always deny more than an upstream decision.

Acceptance criteria

• A governed endpoint cannot serve a request without an applicable active policy/profile.
• Missing or empty required scopes deny rather than becoming a no-op.
• Production-oriented setup enables the required enforcement path by default.
• Status reporting names the exact missing prerequisite without substituting a warning for denial.
• Automated tests cover missing module configuration, missing profile, disabled OAuth enforcement,

missing scopes, and incomplete enforcement wiring.

• Non-governed operation, if retained, is explicit and cannot be selected accidentally by a governed

product path.

Related history

This extends the warning-only lineage without reopening or redefining the earlier closed issue.

API changes

Governed requests gain a deterministic fail-closed error when required governance is unavailable.