Fix IDP full-replacement update safeguards

[cursor]

Description

Fixes a data-loss risk in the new IDP scorecard and scorecard check update operations. These endpoints are documented as full-replacement updates, but the registry accepted partial bodies and forwarded them unchanged. Scorecard updates now require an explicit checks array, and scorecard check updates now require complete rule payloads based on ruleStrategy before any request is sent.

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation
• Other

Checklist

• pnpm test passes
• pnpm typecheck passes
• pnpm build passes
• pnpm standards:check passes (architecture guardrails — see docs/coding-standards.md)
• pnpm docs:check passes (if registry/tool counts changed)

Coding Standards (registry-driven MCP model)

If this PR adds or changes Harness API coverage:

• No new server.registerTool() calls — only toolset definitions in src/registry/toolsets/
• Toolset registered in ALL_TOOLSETS and ToolsetName union
• operationPolicy on every new/changed endpoint
• Shared response extractors from src/registry/extractors.ts (no raw passthrough on real endpoints)
• identifierFields and scope declared on new resources
• No console.log() in src/ (stdio JSON-RPC safety)

Validation

• pnpm exec vitest run tests/registry/scorecard-mutate.test.ts
• pnpm typecheck
• pnpm build
• pnpm standards:check
• pnpm docs:check
• pnpm test (115 files / 2500 tests)

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}