test: strengthen coding-standards guardrails

[cursor]

Description

Audited the codebase against the registry-driven MCP architecture standards in docs/coding-standards.md. The codebase already complies — 89 automated guardrail tests now enforce the rules on every CI run via pnpm standards:check.

This PR strengthens enforcement to prevent drift:

• tests/coding-standards/constants.ts — single source of truth for the 11 allowed MCP tools and handler file paths (used across all standards tests)
• tests/coding-standards/security.test.ts — RateLimiter usage, secrets metadata-only policy, credential logging checks
• docs-consistency.test.ts — AGENTS.md drift guards (11 tools, Zod v4, pnpm standards:check)

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation
• Other

Checklist

• pnpm test passes (2487 tests)
• pnpm standards:check passes (89 tests)
• No new server.registerTool() calls
• No console.log() in src/

Notes on standards snapshot

The automation prompt referenced an older snapshot (10 tools, Zod v3). The canonical standards are documented in docs/coding-standards.md and AGENTS.md:

• 11 consolidated tools (includes harness_schema)
• Zod v4 (import * as z from "zod/v4")
• registerTool() (not deprecated server.tool())
• confirm: true via client elicitation (not confirmation)

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}