Harden fallback in SKILL.md stub to fail fast on MCP auth failures

Previous fallback was too soft: "discover intent, pick the best tool,
confirm assumptions" was interpreted by Codex as "search the local
workspace for kb:// material" — which never exists locally and burns
context on fruitless exploration.

New fallback makes the recovery path explicit:
- STOP on Auth required / server unreachable
- surface the exact fix command (`codex mcp login oci-deal-accelerator`)
  to the user
- never reconstruct the KB from local files (server-side only)
- never invent SKUs, pricing, or service quantities
- never generate partial artifacts with inferred data

Scoped: applies only when the entire MCP session is unreachable.
Per-tool failures still follow the methodology's guidance.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

skills/oci-deal-accelerator/SKILL.md

@@ -36,4 +36,16 @@ Additional knowledge-base resources exposed by the same MCP server:
 
 ## Fallback behavior
 
-If `skill://methodology` cannot be read (MCP unreachable, auth expired, etc.), fall back to: discover customer intent in natural language, select the most specific tool from the table above, and confirm assumptions with the user before generating artifacts. Never invent SKUs or services the user did not request.
+If any MCP call returns `Auth required` (or the server is unreachable), **STOP immediately**. Surface a single clear message to the user:
+
+> The OCI Deal Accelerator MCP session is not authenticated. Run `codex mcp login oci-deal-accelerator` in a separate terminal, then restart Codex. I will retry once you confirm.
+
+Do **NOT**:
+- attempt to reconstruct `kb://*` resources by searching the local workspace — the knowledge base lives **server-side only** and is never present in any cloned repo, plugin cache, or skill directory;
+- invent SKUs, pricing, service names, or quantities to fill the gap;
+- generate partial artifacts (deck, BOM, diagram) using inferred data;
+- retry the same tool call more than once before surfacing the fix to the user.
+
+Exploration of the local filesystem on auth failure wastes context and produces wrong answers. Fail fast, surface the command, wait for the user.
+
+If the resource `skill://methodology` IS readable but a specific downstream tool fails, continue the conversation using the methodology's guidance — the guardrail above applies only to blanket MCP connectivity/auth failures.