Address claude-review round 10 (Option B): pin the empty-scope contract for userinfo-validated tokens in test_mgmt_opaque_userinfo_fallback_accepted_despite_allowlist, so a future @require_scopes on a management endpoint that would silently reject cross-client callers is caught by a test rather than only the docstring. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>