The deny path only cleared the in-memory provider-session map. Every other
prepare path reaches `issueActiveMcpCredential`, which revokes the thread
first, so skipping it left a previously issued bearer token valid against
`/mcp` for the rest of its liveness window — and `touchActiveMcpThread` on
later turns kept refreshing it.

Session restarts for runtime mode, cwd or model re-prepare without stopping,
so they relied on that revoke. An agent whose process outlived the toggle
could have kept driving the browser after the user withheld access, which is
the one outcome this feature exists to prevent.

Reported by the review bot on #7083.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>