MCP server v0.5.0

• Security: update the locked body-parser to 2.4.0, fast-uri to 3.1.9,
  and the qs override to 6.16.1 to resolve known dependency advisories.

• Security: quality_inspector skips every files entry outside
  projectRoot with the same reason before touching the disk. A missing
  path used to get "file does not exist", so a client could tell which host
  paths exist.

• Security: a nav or control that repeats one id in aria-labelledby no
  longer makes inspection walk the labelled element once per repeat. A
  snippet of about 136 KB used to block the server for seconds, and a larger
  one could run it out of memory. Each id now counts once, and only the
  first 32 are read.

• Security: version resolution reads crafted lockfiles in linear time. Blank
  lines inside a pnpm entry, or a long run of ( in a version, used to stall
  every project-scoped tool call for as long as minutes or hours.

• On Windows, a client projectRoot that is a network path (\\host\share)
  is refused before it is resolved, unless it sits under an allowed root.
  Resolving it would contact that host.

• rules_enforcer and the lint command flag the class names, color roles
  and markup paths that ExpressiveCSS 0.16.0 removes, and each finding names
  the replacement. The new rule IDs start with legacy-: material-icons,
  i-icon, visibility-alias, helper-class, renamed-component, picker-root,
  sheet-class, variant-alias, markup-path, carousel-flat, color-role,
  selector, datepicker-range and range-export. Class names match as whole
  tokens in class, JSX className, className={"…"} and template
  literals; legacy-selector covers CSS selectors and query strings.

• The three drag-handle rules select .drag-handle only; .handle is a
  removed name that legacy-sheet-class reports inside a bottom sheet.

• Static inspection no longer stalls the server on adversarial markup. An
  unclosed class value full of btn took 30 s to check and now takes about
  100 ms. Markup nested deeper than 256 elements stops early with
  markup nesting limit reached; 4,000 nested aria-hidden elements took
  20 s before.

• legacy-renamed-component no longer stalls on an unclosed tag that
  repeats class="range. A 500,000-character snippet blocked the server
  for about 10 s.

• Breaking: with EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS unset, a client
  projectRoot must now sit inside the server's default root, from
  --project-root or the working directory. Before, any directory was
  accepted, so a prompt-injected call such as quality_inspector with
  projectRoot: "/" could report whether a file like ~/.ssh/id_rsa
  existed, with its size and SHA-256. A missing projectRoot is now an
  error instead of an unresolved result. To pass other projects, list
  them in EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS.

• A client projectRoot resolves to the real path that passed the root
  check, so swapping a symlink after the check cannot redirect later reads.

• Reading a FIFO inside the project fails at once instead of hanging the call.

• quality_inspector stops its typecheck or test command when the call is
  cancelled or the client closes the session. Before, the command kept
  running after the server exited.

• The lint hook exits 2 when inspection throws, so a crash blocks the edit
  instead of letting the file through unlinted.

• Bundled framework guidance: ExpressiveCSS 0.16.0.