feat(acp): Supervisor.onExit revokes system MCP token (spec §6.3)

- mcpTokens dep added to Supervisor; nil-safe (test fixtures may skip)
- RevokeBySession called after audit Record in onExit
- app.go wires mcpTokenSvc (was nil placeholder)
- Integration test: fakeSupMCPTokens verifies onExit calls RevokeBySession

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/acp/handler_e2e_test.go

@@ -130,6 +130,7 @@ func TestHandler_Session_CreateAndWS_E2E(t *testing.T) {
 		audit.NewPostgresRecorder(pool),
 		disp,
 		nil, nil, // wtSvc/wsRepo: IsMainWorktree=true path → not called
+		nil, // mcpTokens
 		enc,
 		acp.SupervisorConfig{
 			SpawnTimeout:       5 * time.Second,