Fixes #23006.

Regression:

• In 2026.2.19+ we introduced operator.read/operator.write scopes.
• Legacy paired devices may have operator.admin but not operator.write.
• Gateways treat operator.admin as satisfying operator.read, but not operator.write, so operator.write requests trigger repeated scope-upgrade pairing loops.

Fix:

• Update operator scope compatibility so operator.write is satisfied by operator.write OR operator.admin.

Tests:

• Update unit tests for roleScopesAllow
• Add/adjust device-pairing verifyDeviceToken test to ensure operator.admin allows operator.write

Greptile Summary

Fixes pairing loop regression from 2026.2.19 where legacy devices with operator.admin scope triggered repeated pairing when requesting operator.write access. The change adds scope compatibility logic in operatorScopeSatisfied() at src/shared/operator-scope-compat.ts:25-26 so operator.admin satisfies operator.write requests, mirroring the existing behavior for operator.read.

The fix is minimal and correct:

• Logic change is 2 lines in the core compatibility function
• Tests verify both operator.read and operator.write are satisfied by operator.admin tokens
• Device pairing test confirms the end-to-end flow works correctly

Issue: Missing CHANGELOG entry. This is a user-facing bug fix (resolves #23006 pairing loop) and per repository guidelines should have a changelog entry in the Fixes section. The CHANGELOG only has an unrelated attribution update on line 19.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The fix is straightforward, well-tested, and addresses a specific regression. The 2-line logic change mirrors existing behavior for operator.read, has comprehensive test coverage (unit tests + integration test), and resolves a documented issue ([Bug] 2026.2.19 upgrade breaks tool connections — missing operator.write and operator.read scopes on existing paired devices #23006). The only non-critical issue is the missing CHANGELOG entry.
• No files require special attention - the implementation is clean and well-tested

_{Last reviewed commit: e99592d}