feat(#1681): ADR-1239 Phase C-2 — gsd-mcp-server bin entry + lifecycle test [slice 3b] (#1810)

* feat(#1681): ADR-1239 Phase C-2 — gsd-mcp-server bin entry + lifecycle test [slice 3b]

Phase 4 slice 3b (closes #1681). The companion MCP server bin entry so any
MCP-consuming host connects via 'npx gsd-mcp-server' (or its bin on PATH) and
gets GSD command (point 1) + state IO (point 5) with no bespoke plugin.

- gsd-core/bin/gsd-mcp-server.cjs: #!/usr/bin/env node shim requiring
  ./lib/mcp-server.cjs + runServer({stdin, stdout}); non-zero exit on fatal
  error (justified n/no-process-exit disable). Mirrors gsd-tools.cjs.
- package.json: add 'gsd-mcp-server' bin entry.
- tests/gsd-mcp-server-bin.test.cjs: 3 process-lifecycle tests — initialize +
  tools/list round-trip + clean exit, malformed-line -> parse error + server
  keeps running, empty stdin -> clean exit. Synchronous spawnSync (bounded;
  server exits on stdin EOF, no orphan).

Phase 4 trust-gate (#1806) + loader wiring (#1808) + server module (#1809) +
this bin/lifecycle slice = all of #1681's deliverables. Concrete host binding ->
Phase 5 (#1682). npm-integrity + eslint + security + inventory all clean.

* docs(#1681)+chore(changeset): how-to for the companion MCP server + Added fragment

docs/how-to/connect-gsd-mcp-server.md — Diataxis how-to guide for connecting
any MCP-capable host to gsd-mcp-server: goal-oriented flow (add config → restart
→ verify), real-world per-host conditionals, troubleshooting, and a trimmed
reference table. Explanation/reference linked out (ADR-1239, capability-trust-
model) per Diataxis boundary rules rather than mixed in.

.changeset/humble-seals-rest.md — type: Added (first user-reachable surface of
the epic: a new bin command). The how-to doc satisfies the docs-required gate.

* fix(#1681): move gsd-mcp-server shim to top-level bin/ (out of the runtime-copied tree)

The shim at gsd-core/bin/gsd-mcp-server.cjs was inside the tree the installer
copies into every runtime config dir, so it leaked into all 16 runtimes and
broke golden-install-parity. The MCP server is a PACKAGE bin the host spawns
(npx gsd-mcp-server), not a per-runtime artifact — so it belongs at top-level
bin/ alongside install.js (which is also never copied into a runtime config).

- gsd-core/bin/gsd-mcp-server.cjs -> bin/gsd-mcp-server.js (require path now
  ../gsd-core/bin/lib/mcp-server.cjs).
- package.json: bin entry -> bin/gsd-mcp-server.js.
- tests/gsd-mcp-server-bin.test.cjs: SHIM path updated.
- eslint.config.mjs: add bin/gsd-mcp-server.js to the bin/install.js block
  (drops the n/no-process-exit disable — the n plugin isn't loaded for that
  block, so the disable referenced an undefined rule).

golden-install-parity 16/16 restored; lifecycle + unit tests green; eslint 0;
lint:ci all ok.

bin/gsd-mcp-server.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+'use strict';
+/**
+ * gsd-mcp-server — companion MCP server bin entry (ADR-1239 Phase C-2 / #1681).
+ *
+ * Lives at top-level bin/ (alongside install.js) — it is a PACKAGE bin the host
+ * spawns via `npx gsd-mcp-server` (or the global bin), NOT a per-runtime
+ * artifact copied into a host's config dir. (Placing it under gsd-core/bin/
+ * would leak it into every runtime install + break golden parity.)
+ *
+ * A stdio JSON-RPC 2.0 server exposing GSD interface points 1 (command) + 5
+ * (state IO) so any MCP-consuming host (Claude/Codex/OpenCode/VS Code/Gemini/
+ * Cursor/Cline/Hermes) can drive GSD with no bespoke plugin. Delegates to the
+ * tested server module (gsd-core/bin/lib/mcp-server.cjs runServer). Reads
+ * line-delimited JSON-RPC from stdin, writes one response + newline per
+ * request, exits cleanly when stdin closes.
+ *
+ * The protocol logic (handleMessage) + the injectable-stream loop (runServer)
+ * are unit-tested in tests/gsd-mcp-server.test.cjs; the process lifecycle
+ * (spawn → JSON-RPC → clean exit) in tests/gsd-mcp-server-bin.test.cjs.
+ */
+const { runServer } = require('../gsd-core/bin/lib/mcp-server.cjs');
+
+runServer({
+  input: process.stdin,
+  output: process.stdout,
+  ctx: { cwd: process.cwd() },
+}).catch((err) => {
+  process.stderr.write(String((err && err.message) || err) + '\n');
+  process.exit(1);
+});