mcphttp: the MCP endpoint plumbing both services already share

hostAllowed is byte-identical in cov and bench, and neither should own it.
PrivateCache is cov's alone today, which is why bench's /mcp currently sets
no Cache-Control and no Vary at all. StreamableOptions carries the pair both
pass and the reason for it.

HostGuard takes cov's fail-closed stance: an origin with no host to guard
with is a construction error, not a warning. bench serves unguarded in that
case and has a test pinning it; reconciling that is bench's to do.

Deliberately not a shared MCP framework. Once the go-sdk and the per-service
tools are subtracted, this is the whole overlap.

chimw: the chi-shaped helpers of the custom services

GetHead registers a read route under GET and HEAD both, which cover, bench
and tokens had each spelled out — five copies of three lines, under three
names. RenderRefusals points chi's NotFound and MethodNotAllowed at the
service's own error page, which spec and dolt install neither of, so a
mistyped URL there is the one refusal on the instance that answers in
plain text. RequestLogger is a chi LogFormatter emitting slog records, in
place of chi's colourised stdlib line on stdout — the highest-volume line
a service writes and the only one that was neither structured nor on
stderr.

It is a second middleware package and not a wing of the first because
sr-ht-ecore/middleware needs nothing but net/http and that rule is worth
keeping; the boundary is whether the helper has to know what a route is.

A request line is Info, a 5xx is Error, and 499 stays Info by being below
500, which is what that code was chosen for. Skipping probe noise is the
caller's call, through a predicate. The logger goes outside RecoverPanics
so the line reports the error page that was rendered rather than the
nothing an unwinding stack has written.

bearer: the shared working-token validator of SPEC ch. 6

chrome: shared page chrome for the instance's custom services

Extract the nav/chrome idiom that compare, spec, dolt and cover each
carried as a private copy (and bench was about to fork as a sixth):
BuildNav over the shared config.ini with the canonical ordering and
paste/pages/hub exclusions, a per-request Page with login/logout/profile
URLs against meta's unified login, embedded srht-nav / srht-env-banner
partials (circle brand + red service label + switcher + login box), and
the generic dict/shortsha template helpers.

Policy decisions the copies had drifted on are baked in: switcher only
for authenticated viewers, hub excluded in the builder rather than the
template, profile link prefers hub's ~username page, environment name
uppercased for the banner. Service-specific needs surfaced by the cover
survey get seams instead of copies: ExtraNav for extra switcher entries,
ContainerClass for full-bleed pages, the config section as an explicit
parameter for the active check.