Authenticate the quality-gate pip install with the private index URL (scheme-stripped AUTH_URL, --index-url/--extra-index-url) instead of the broken --extra-index-url form, and guard against missing PIP_* secrets. Also drop the fetch-tags inline comments. Regenerated the mcp copy from src.