Tighten scope delimiter regex and fix bogus test

- Narrow regex from /[\s,]+/ to /[ ,]+/ to match server-side
  Access::ScopeSet.parse_scopes behavior (space and comma only)
- Remove dead .trim() — splitting on /[ ,]+/ can't produce
  elements with leading/trailing whitespace
- Fix test that claimed to cover space-separated parsing but
  actually passed comma-separated input (exercising no new code)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: RyanDJLee

packages/cli/src/cli/services/store/auth/scopes.test.ts

@@ -29,12 +29,12 @@ describe('store auth scope helpers', () => {
     ])
   })
 
-  test('resolveGrantedScopes succeeds when requested scopes were space-separated', () => {
+  test('resolveGrantedScopes succeeds when granted scopes are space-separated', () => {
     expect(
       resolveGrantedScopes(
         {
           access_token: 'token',
-          scope: 'read_products,read_inventory',
+          scope: 'read_products read_inventory',
         },
         ['read_products', 'read_inventory'],
       ),

packages/cli/src/cli/services/store/auth/scopes.ts

@@ -4,8 +4,7 @@ import type {StoreTokenResponse} from './token-client.js'
 
 export function parseStoreAuthScopes(input: string): string[] {
   const scopes = input
-    .split(/[\s,]+/)
-    .map((scope) => scope.trim())
+    .split(/[ ,]+/)
     .filter(Boolean)
 
   if (scopes.length === 0) {