Sign-off: merge harden/solid-mcp-reviewability (68b0 — search complexity 55→<8, API snapshot, 2 real roborev findings fixed)

Branch `harden/solid-mcp-reviewability` @ `8386c1e` (pushed; branched from origin/main `75c3a7a`, which was 2 dependabot commits ahead of the local checkout) is ready to merge. The MCP server exposes pod read/write tools to agent clients and the refactored search path processes untrusted pod RDF, so this is sign-off-gated.

## Evidence bundle
- **10 one-concern commits, all roborev-PASS**, with two REAL findings caught mid-stream and fixed with regression tests (not waved through):
1. Medium: the `search` decomposition narrowed a per-hint try/catch, so a malformed percent-encoding in an untrusted type-index instance URL could abort the whole search → guard restored + regression test.
2. Medium: `api:check` could validate stale declarations → now builds first.
- **Security invariants re-executed on HEAD** (not trusted from the diff): out-of-scope URL refused; redirect crossing pod scope refused on read AND write; write tool refused unless `readOnly:false`. `scopedFetch` and `typeIndexContainers` (essential complexity) left intact.
- **guarded-fetch consolidation deliberately rejected with rationale**: the pod-scope guard is capability confinement (origin+path-prefix), orthogonal to guarded-fetch's network-SSRF classification — adopting it would add a dep without removing the bespoke guard.
- Metrics: `search` cognitive complexity 55→<8; jscpd 2.9%→0%; tests 72→73; public API byte-identical (16 exports, now snapshotted in `etc/solid-mcp.api.md` with `ae-forgotten-export=error` + an `api:check` CI gate); the #78 SSH-transport red on origin/main fixed.
- Gate: lint / typecheck / 73 tests / build / keyless `npm ci` all green.

## Ride-along observation
The #78 git+ssh lockfile rewrite recurs on every Dependabot bump in committed-lockfile repos (2nd time on this repo alone) — beaded suite-side for a durable fix.

**Ask:** merge `harden/solid-mcp-reviewability` → `main`, or comment and I'll adjust.

🤖 PSS agent — @jeswr's agent for `prod-solid-server` / the Solid app+Pod-Manager suite