fix: guard IDP full-replacement updates

[cursor]

Description

Fixes a destructive IDP scorecard update path introduced with the new IDP write support. Scorecard updates are full replacements, but the update body previously accepted { scorecard: {...} } without checks, allowing an agent editing metadata to replace a populated scorecard with one containing no checks. The fix makes scorecard updates require the complete checks array and adds update-only target consistency guards for scorecards, scorecard checks, and IDP entity YAML updates so path/body mismatches fail before any Harness API call.

Bug and impact:

• A harness_update(resource_type="scorecard", ...) call with a scorecard body but no checks could silently drop all checks from an existing scorecard because the API update is a full replacement.

Root cause:

• The new scorecard create and update paths shared the same permissive body builder/schema even though create can omit checks while update must round-trip the complete body from harness_get.

Fix:

• Added a scorecard update body builder/schema that requires checks.
• Added update-only identifier consistency checks for scorecard.identifier, checkDetails.identifier, and IDP entity YAML kind/metadata.name versus the path target.
• Added focused registry regressions proving invalid update requests fail before dispatch.

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation
• Other

Checklist

• pnpm test passes
• pnpm typecheck passes
• pnpm build passes
• pnpm standards:check passes (architecture guardrails — see docs/coding-standards.md)
• pnpm docs:check passes (if registry/tool counts changed)

Coding Standards (registry-driven MCP model)

If this PR adds or changes Harness API coverage:

• No new server.registerTool() calls — only toolset definitions in src/registry/toolsets/
• Toolset already registered in ALL_TOOLSETS and ToolsetName union
• operationPolicy on every new/changed endpoint
• Shared response extractors from src/registry/extractors.ts (no raw passthrough changes in this PR)
• identifierFields and scope already declared on changed resources
• No console.log() in src/

Validation performed:

• pnpm exec vitest run tests/registry/scorecard-mutate.test.ts tests/registry/idp-entity.test.ts
• pnpm build
• pnpm typecheck
• pnpm docs:check
• pnpm test (115 files / 2502 tests)
• pnpm standards:check

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}