fix(mcp): move pack validation out of unit suite

[yansigit]

Summary

• Remove the live npm pack subprocess from the concurrent MCP files unit test.
• Share the static MCP import-closure and package-file policy helpers between unit tests and the pack gate.
• Extend check:pack-artifact / check:pack-policy to reject packed test/spec files and missing MCP closure paths, including npm workspace JSON output.

Related Issues

• Related to [BUG] missing dependency when using --mcp flag #3578
• Related to Expose Arena ELO sync in feature flags #3821

Validation

• Change type: build-deploy / test infrastructure
• Focused MCP and pack-policy tests (22/22 passing)
• npm run lint — inherited base failures in tests/unit/combo/image-combo.test.ts (any violations; introduced by base feat(images): add full combo strategy execution for image generation (#9239) #9499) and open-sse/config/providers/registry/deepai/index.ts (missing ../shared; introduced by base feat(providers): add DeepAI as paid image provider (#6671) #9443)
• npm run typecheck:core — same inherited DeepAI base failure
• npm run check:pack-policy
• npm run check:changelog-integrity
• Reconciled with the active release/v3.8.50 base (5fd2325)
• Production-side gate changes include updated automated tests
• SonarQube PR analysis (CI-owned)

Tests Added Or Updated

• tests/unit/mcp-published-files-closure-3578.test.ts
• tests/unit/mcp-published-files-closure-helpers.test.ts
• tests/unit/pack-artifact-policy.test.ts

Coverage Notes

This changes build/validation scripts rather than src/, open-sse/, electron/, or bin/ runtime code. The focused policy tests cover the new closure, test-leak, and npm-output parsing helpers.

Reviewer Notes

The real pack walk remains intentionally in the dedicated pack-artifact gate and uses --ignore-scripts; the concurrent unit suite now performs only static checks and completes in milliseconds.

⚠️ base-red inherited: #9985. The active release/v3.8.50 base currently has an open release-green issue. After reconciling with the current base (5fd2325), the full lint/typecheck failures remain outside this PR diff in the two files listed above; they are inherited and are not introduced by this branch.

[diegosouzapw]

Merged into release/v3.8.50 — thank you @yansigit for the contribution! It was validated on a combined merge-train (static gates + affected tests + vitest) together with 30 sibling PRs before landing.