fix(gateway): internal-op invisibility on /schema + cache headers (SRV-02, PRJ-06, GW-02)

- SRV-02: schema_handler applies the same is_internal_op -> 404 pre-check
  as /call, /batch, /subscribe, /publish (tested unauthenticated,
  anonymous-token, unauthorized-identity)
- PRJ-06: MCP schema tool runs the symmetric pre-check (NOT_FOUND for
  internal, FORBIDDEN for ACL-denied) before dispatch; enshrining test
  fixed
- GW-02: /search + /schema carry Cache-Control: no-store and
  Vary: Authorization on success and error responses

Verification: cargo test 270 passed; --all-features 337+9+6+8+10 passed;
clippy -D warnings clean (default + --all-features); fmt clean.

tasks/server/review-001-schema-internal-visibility.md

@@ -1,7 +1,7 @@
 ---
 id: review-001-schema-internal-visibility
 name: Enforce Internal-op invisibility on GET /schema (SRV-02, PRJ-06, GW-02)
-status: pending
+status: completed
 depends_on: []
 scope: narrow
 risk: medium
@@ -39,11 +39,11 @@ to the two per-identity GETs.
 
 ## Acceptance Criteria
 
-- [ ] `GET /schema?name=<internal>` → 404 unauthenticated, for an unauthorized identity, and for an anonymous identity (test)
-- [ ] MCP `schema` tool denies/404s unauthorized ops symmetrically with HTTP `/schema` (test); enshrining test fixed
-- [ ] `/search` + `/schema` responses carry `Cache-Control: no-store` (and `Vary: Authorization` where a token can change the body)
-- [ ] `cargo test` and `cargo clippy --all-targets -- -D warnings` pass
-- [ ] `cargo test --all-features` passes (the MCP half is feature-gated)
+- [x] `GET /schema?name=<internal>` → 404 unauthenticated, for an unauthorized identity, and for an anonymous identity (test)
+- [x] MCP `schema` tool denies/404s unauthorized ops symmetrically with HTTP `/schema` (test); enshrining test fixed
+- [x] `/search` + `/schema` responses carry `Cache-Control: no-store` (and `Vary: Authorization` where a token can change the body)
+- [x] `cargo test` and `cargo clippy --all-targets -- -D warnings` pass
+- [x] `cargo test --all-features` passes (the MCP half is feature-gated)
 
 ## References
 
@@ -53,8 +53,43 @@ to the two per-identity GETs.
 
 ## Notes
 
-> Agent fills during implementation.
+- GW-02 headers are applied to **all** responses the two GET routes emit
+  (200 and denial paths alike) — a 401/403/404 response is equally
+  caller-specific and must not be cached.
+- `with_no_cache_headers` is a small helper applied inside
+  `schema_handler`'s pre-check returns plus a `discovery_get_response`
+  wrapper on the dispatch path; `/call`, `/batch`, `/subscribe`,
+  `/publish` (non-GET, non-per-identity-response) are untouched.
+- The `/schema` 404 guard mirrors `call_handler` exactly: `is_internal_op`
+  pre-check before `access_check_for_op`, same `not_found_response`
+  shape, so a caller cannot distinguish internal from unknown ops.
+- MCP `schema` uses the registry-backed guard
+  (`schema_visibility_and_access_denial`) rather than intercepting the
+  `services/schema` dispatch — symmetric with HTTP (NOT_FOUND for
+  Internal, FORBIDDEN for ACL) and it never reaches the discovery
+  handler for forbidden names.
+- Notable: `registry.list_operations()` returns External-only and the
+  test fixture built from it drops Internal ops from the dispatch
+  registry — the new tests use the direct-registration fixture
+  (`registry_with_internal_op`), mirroring `call_internal_op_returns_404`.
 
 ## Summary
 
-> Filled on completion.
+Fixed the three faces of the Internal-op invisibility gap (review-001
+SRV-02, PRJ-06, GW-02):
+
+- SRV-02: `schema_handler` now applies the same `is_internal_op` → 404
+  pre-check as `/call`, `/batch`, `/subscribe`, `/publish`; tests cover
+  unauthenticated, anonymous-token, and unauthorized-identity callers.
+- PRJ-06: the MCP `schema` tool runs the symmetric pre-check
+  (`NOT_FOUND` for `Visibility::Internal`, `FORBIDDEN` for ACL-denied)
+  before dispatching to `services/schema`; the enshrining
+  `schema_returns_full_operation_spec` test no longer fetches with no
+  identity and asserts `access_control` presence (spec now fetched for
+  an unrestricted op, `access_control` asserted only via the new
+  authorized-identity test).
+- GW-02: `/search` + `/schema` responses carry `Cache-Control: no-store`
+  and `Vary: Authorization` on both success and error paths.
+
+Verification: cargo test 270 passed; cargo test --all-features 337+9+6+8+10
+passed; clippy -D warnings clean (default and --all-features); fmt clean.