test: allowlist the consent journey's origin-only goto

The MCP consent journey navigates to /api/version only to give the page
an origin, then registers the OAuth client with the page's own fetch.
That evaluate reads no DOM, the same shape as the allowlisted vaccination
seed, and the consent page after it is gated on the Allow button.

src/__tests__/e2e-measurement-gating-guard.test.ts

@@ -39,6 +39,11 @@ const ALLOWLIST: ReadonlyArray<{ file: string; test: string; why: string }> = [
     test: "the list and the capture form carry no serious accessibility violations",
     why: "The evaluate after the goto reads no DOM: it issues the seed POST from the page's own origin so the row is written over the browser's socket rather than the runner's shared keep-alive agent, which handed POSTs to sockets the server had already closed. The scan that follows is gated on the reloaded list.",
   },
+  {
+    file: "mcp-oauth-consent-redirect.spec.ts",
+    test: "Allow lands on the client's callback with a code",
+    why: "The evaluate after the goto reads no DOM: the goto only gives the page an origin, and the evaluate registers the OAuth client from it so the POST travels over the browser's socket rather than the runner's shared keep-alive agent. The consent page that follows is gated on the Allow button being visible.",
+  },
   {
     file: "ipad-viewport.spec.ts",
     test: "no horizontal overflow and full-width content on",