test(mcp): add stdio integration coverage - #100

Closes #31

Summary

• run the built headless-mcp process through initialize, notifications, tool discovery, and a real browser-command round trip
• cover malformed input, oversized input, and rejection of local CLI commands over MCP
• wire the suite into the existing protocol/security test entry point
• mark backlog C3 complete and document the added coverage

Verification

• docker run --rm -v "$PWD:/work" -w /work swift:6.1-bookworm bash apps/headless/test.sh (32/32 protocol tests; MCP integration passed)
• npx --yes pnpm@9.15.0 test:runtime
• git diff --check