sr-ht-dolt-cwl Add Flush hook to mcpsrv cacheWriter so MCP answers keep Cache-Control/Vary Lined Up

What is wrong: `mcpsrv/mcpsrv.go::cacheWriter` stamps `Cache-Control: private, no-store, no-transform` and `Vary` at commit time by hooking `WriteHeader` and `Write`, but not `Flush`. A response committed through a flush never reaches `commit()` and ships with neither header; because `cacheWriter` embeds the `http.ResponseWriter` interface, a `w.(http.Flusher)` assertion in the MCP SDK also fails outright.

Why it matters: this is a security defect, not a style issue. dolt's MCP surface can answer with data scoped to the caller, and without `Vary` a shared/intermediate cache keys the answer on the URL alone and can hand a flushed response to the next caller regardless of credentials. `httptest.ResponseRecorder`-based tests structurally cannot catch this — it needs a real-socket, flush-before-write test.

Sibling that already does it correctly: `sr-ht-ecore/mcphttp/cache.go::cacheWriter` (commit 3bd158f) fixes this with a proper Flush hook; artifacts (6c44e03) and bench (7173a3e, test `TestHeadersLandOnAFlush`) and specs (824788a) and curator carry the fix locally.

Fix: replace dolt's private `cacheWriter`/`privateCache` with `mcphttp.PrivateCache` from the ecore revision dolt already pins (see the related D10 issue on adopting mcphttp generally); failing that, add a `Flush` method that calls `commit()` then `http.NewResponseController(w.ResponseWriter).Flush()`, and add a real-socket flush test, not a recorder test.

Status: verified — cacheWriter has 0 Flush methods in dolt's mcpsrv package (confirmed by counting method sets across all six mcpsrv packages).

Audit: D02 (cross-repo audit, 2026-08-17)