fix(serve): add mcp_guardrails to E2E capabilities expectation

PR #4247 (`feat(serve): MCP client guardrails`) added the always-on
`mcp_guardrails` capability to `SERVE_CAPABILITY_REGISTRY` and updated
the unit-level `EXPECTED_STAGE1_FEATURES` in
`packages/cli/src/serve/server.test.ts`, but missed the matching
integration-test expectation. The E2E `qwen serve — capabilities
envelope > advertises all baseline capabilities` assertion has been
failing on `main` since #4247 landed.

Append `'mcp_guardrails'` to the expected `caps.features` array, in the
same position as `SERVE_CAPABILITY_REGISTRY` and the unit-level
constant (after `session_metadata`, before the conditional
`require_auth`). No production code changes.

integration-tests/cli/qwen-serve-routes.test.ts

@@ -214,6 +214,7 @@ describe('qwen serve — capabilities envelope', () => {
       'session_supported_commands',
       'session_close',
       'session_metadata',
+      'mcp_guardrails',
     ]);
   });
 });