feat: enhanced structural validation for mcpb validate (#57)

Add three pre-pack validators to catch common runtime failures early:

- validateEntryPoint: checks file exists, extension matches server type,
  binary has executable bit (Unix)
- validateCommandVariables: scans mcp_config for unrecognized ${...}
  variables against the runtime allowlist
- validateSensitiveFiles: warns about credentials.json, *.pem, *.key,
  .ssh/, etc. that would be bundled

validateManifest() now accepts optional { projectDir } to separate the
manifest directory from the source file directory.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

test/icon-validation.test.ts

@@ -93,6 +93,10 @@ describe("Icon Validation", () => {
       "Not a PNG file",
     );
 
+    // Create entry point file referenced by test manifests
+    fs.mkdirSync(join(testFixturesDir, "server"), { recursive: true });
+    fs.writeFileSync(join(testFixturesDir, "server", "index.js"), "// fixture");
+
     // Create test manifests
     createTestManifest("valid-local-icon.json", {
       icon: "valid-icon.png",