fix(codegen): sanitize JSDoc strings and add package.json to generated output

[bug-ops]

Summary

• Fixes server-controlled strings (name, version, tool name, tool description) being interpolated verbatim into JSDoc block comments, allowing malicious MCP servers to inject arbitrary TypeScript via */ sequences (codegen: server-controlled strings interpolated into JSDoc comments without sanitizing comment terminator #87)
• Adds package.json with {"type":"module"} to generated server output directory, eliminating the Node.js MODULE_TYPELESS_PACKAGE_JSON performance warning on every tool execution (generate: missing package.json in output directory causes Node.js ES module warning on every tool execution #86)

Changes

crates/mcp-codegen/src/progressive/generator.rs

• Added sanitize_jsdoc(s: &str, max_len: usize) -> String — replaces */ with *\/, strips CR/LF, truncates to max_len chars
• Applied sanitizer in create_tool_context (tool name, description) and create_index_context (server_name, server_version, each tool description)
• Added package.json generation in generate() and generate_with_categories()
• Added unit tests: test_sanitize_jsdoc_* (4 cases) and test_generate_sanitizes_jsdoc_injection
• Updated test_generate_progressive_files to expect 5 files

crates/mcp-codegen/tests/progressive_generation.rs

• Updated file count expectations (now 6 for 3-tool server, 3 for empty server)
• Added package.json assertions

Test plan

• cargo +stable clippy --all-targets --all-features --workspace -- -D warnings — clean
• cargo nextest run --all-features --workspace --no-fail-fast — 641 passed
• cargo test --doc --all-features --workspace — 9 passed
• cargo +nightly fmt --check — clean

Closes #87
Closes #86

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@            Coverage Diff             @@
##           master      #91      +/-   ##
==========================================
+ Coverage   88.97%   89.03%   +0.06%     
==========================================
  Files          33       33              
  Lines        7708     7751      +43     
==========================================
+ Hits         6858     6901      +43     
  Misses        850      850              

Flag	Coverage Δ
mcp-cli	89.03% <100.00%> (+0.06%)	⬆️
mcp-codegen	89.03% <100.00%> (+0.06%)	⬆️
mcp-core	89.03% <100.00%> (+0.06%)	⬆️
mcp-files	89.03% <100.00%> (+0.06%)	⬆️
mcp-introspector	89.03% <100.00%> (+0.06%)	⬆️
mcp-server	89.03% <100.00%> (+0.06%)	⬆️
mcp-skill	89.03% <100.00%> (+0.06%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
crates/mcp-codegen/src/progressive/generator.rs	96.25% <100.00%> (+0.52%)	⬆️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.