fix(scripts): pass MCP callTool timeouts as request options (#2387)

@modelcontextprotocol/client 2.3.1 declares callTool(params, options).
Three verifiers still used the v1 shape callTool(params, undefined,
{ timeout }), so the third argument was dropped and those calls ran
under the SDK's 60 s default instead of the 150-180 s they request.
Pass the options second.

scripts/verify-real-ghidra-mips-relocatable.mjs

@@ -124,9 +124,7 @@ async function verifyFixture(byteOrder, kernelModule) {
   });
   const call = async (name, args = {}) =>
     requireMcpOperationResult(
-      await client.callTool({ name, arguments: args }, undefined, {
-        timeout: 180000,
-      }),
+      await client.callTool({ name, arguments: args }, { timeout: 180000 }),
       name,
     );
   try {

scripts/verify-real-ghidra-mips.mjs

@@ -171,7 +171,6 @@ try {
     const call = async (name, args = {}) => {
       const reply = await client.callTool(
         { name, arguments: args },
-        undefined,
         { timeout: 180000 },
       );
       return requireMcpOperationResult(reply, name);
@@ -184,7 +183,6 @@ try {
             name: "open_binary",
             arguments: { path: fixture.path, provider_id: "ghidra" },
           },
-          undefined,
           { timeout: 60000 },
         );
         const error = requireMcpToolError(rejected);
@@ -423,7 +421,6 @@ try {
               snapshot_path: snapshotPath,
             },
           },
-          undefined,
           { timeout: 180000 },
         );
         requireMcpToolError(wrongSnapshot);

scripts/verify/javascript/recovery.mjs

@@ -41,9 +41,10 @@ const cli = async (...args) => {
   return parseEvidence(JSON.parse(stdout));
 };
 const call = async (name, args) => {
-  const result = await client.callTool({ name, arguments: args }, undefined, {
-    timeout: 150000,
-  });
+  const result = await client.callTool(
+    { name, arguments: args },
+    { timeout: 150000 },
+  );
   assert.notEqual(result.isError, true, mcpTextValue(result));
   return parseEvidence(JSON.parse(mcpTextValue(result)));
 };