fix: mcp.json server-path gate selects the ${PLUGIN_ROOT} arg instead of joining args

[devin-ai-integration]

Summary

Follow-up to #24, from a Devin Review finding on the conformance gate. The gate that proves mcp.json points at a real server file derived its path by joining all args, which fails in both directions:

// before
const target = (ingest.args || []).join(' ').replace('${PLUGIN_ROOT}/', '')
// args: []        -> target ''  -> path.join(root, '') === root -> exists -> OK (gate blind)
// args: ['--enable-source-maps', '${PLUGIN_ROOT}/mcp/.../server.js']
//                 -> target '--enable-source-maps mcp/.../server.js' -> spurious FAIL

Now it picks the one ${PLUGIN_ROOT}-relative arg and fails loudly when there isn't one:

const rootArg = (ingest.args || []).find(a => String(a).startsWith('${PLUGIN_ROOT}/'))

Verified by mutating mcp.json and running node bin/check.js each time:

args	before	after
[]	OK (blind)	FAIL: must pass a ${PLUGIN_ROOT}-relative server path
['--enable-source-maps', '${PLUGIN_ROOT}/…/server.js']	FAIL (spurious)	OK
['${PLUGIN_ROOT}/mcp/nope.js']	FAIL	FAIL: points at missing mcp/nope.js

npm run check: 74/74 tests pass. Gate-only change; no runtime behavior touched.

Link to Devin session: https://app.devin.ai/sessions/f135381c4682413bae73dff38eb6d1a3
Requested by: @suboss87

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.