test(cli): add httpapi exerciser scenarios for MCP Apps endpoints

The httpapi coverage gate requires every declared route to have a
scenario. Add Kilo-owned scenarios for POST /experimental/resource/read
and POST /experimental/mcp/call-tool asserting the flag-gated 404 (the
exerciser runs with experimentalMcpApps off).

packages/opencode/.kilo/tui.json

@@ -0,0 +1 @@
+{}

packages/opencode/test/kilocode/server/httpapi-exercise-scenarios.ts

@@ -197,6 +197,24 @@ export const kiloScenarios: Scenario[] = [
       body: { name: "httpapi-mcp", config: { type: "remote", url: "https://mcp-edit.example.test" } },
     }))
     .json(200, object),
+  // MCP Apps experimental endpoints are gated behind experimentalMcpApps; the exerciser runs with the
+  // flag off, so both routes return 404 before touching any MCP client.
+  http.protected
+    .post("/experimental/resource/read", "mcp.readResource")
+    .at((ctx) => ({
+      path: "/experimental/resource/read",
+      headers: ctx.headers(),
+      body: { server: "httpapi-missing", uri: "ui://httpapi/missing" },
+    }))
+    .status(404),
+  http.protected
+    .post("/experimental/mcp/call-tool", "mcp.callTool")
+    .at((ctx) => ({
+      path: "/experimental/mcp/call-tool",
+      headers: ctx.headers(),
+      body: { server: "httpapi-missing", name: "noop", arguments: {} },
+    }))
+    .status(404),
   http.protected.get("/config/sources", "config.sources").json(200, object),
   http.protected.get("/tui/config", "tui.config.get").json(200, object),
   http.protected.get("/tui/keybinds", "tui.keybind.list").json(200, object),