sr-ht-ecore-6r2 Parameterize the hardcoded Vary header in mcphttp.PrivateCache so dolt can adopt mcphttp Lined Up

What is wrong: sr-ht-ecore/mcphttp/cache.go's PrivateCache hardcodes vary = "Cookie, Authorization". This is the one stated blocker preventing sourcehut-dolt from importing mcphttp instead of carrying its own private copy, since dolt deliberately uses Vary: Authorization alone.

Why it matters: mcphttp was extracted precisely because the Host guard, the commit-time cache wrapper and the two transport options are byte-identical across six services (artifacts, bench, coverage, curator, dolt, specs) — yet nothing imports it (grep across all nine service trees returns zero real imports, only two doc-comment mentions in bench and specs falsely claiming the swap is blocked because the ecore commit adding mcphttp is unpublished/unpinned — verifiably false, both pinned ecore revisions already contain the package). Because each service kept its own private copy, the identical cacheWriter.Flush bug was independently discovered and fixed twice (ecore 3bd158f/00d7582, artifacts 6c44e03), and two other defects in this same audit (a service missing Stateless: true, two services missing Flush on their cacheWriter) are direct consequences of copy-don't-import continuing instead of the package being adopted.

Correct variant: mcphttp itself, once this one blocker is removed.

Fix: make vary a parameter/field on mcphttp.PrivateCache (or on StreamableOptions), defaulting to "Cookie, Authorization" but overridable so dolt can pass "Authorization" alone. This unblocks each of the six services deleting their private privateCache/cacheWriter/allowHosts/hostAllowed copies and importing mcphttp directly — that consumer-side work is separate follow-up work per repo, not part of this issue.

Confidence: verified (two doc-comment mentions found, zero real imports; both services' pinned sr-ht-ecore revisions confirmed to already contain mcphttp).

Audit: D10 (cross-repo audit, 2026-08-17)