fix(percy): disable runPercyScan

[manoj-k04]

Summary

• Temporary fix for PMAA-100 / HackerOne #3576387: runPercyScan was embedding the server-fetched Percy token in plaintext inside the tool response (export PERCY_TOKEN="<actual_token>").
• Disables the runPercyScan MCP tool registration in src/tools/percy-sdk.ts so the leaking code path is no longer reachable via tools/list / tools/call.
• Underlying source (src/tools/run-percy-scan.ts) is untouched — it remains exported and unit-tested. The proper fix (replacing the interpolated token with a placeholder) will land in the planned sprint per Gaurav's note on the ticket.
• Note: a similar plaintext-token emission pattern exists in src/tools/sdk-utils/percy-web/handler.ts (called from expandPercyVisualTesting). Reporter flagged it under "Code References" in the original H1 submission. Out of scope for this temp fix per Pradum's instruction; should be addressed in the proper-fix PR.

Test plan

• npm run lint
• npx tsc --noEmit
• npm test — 122/122 pass
• Reviewer: confirm runPercyScan no longer appears in tools/list from a connected MCP client