chore: runtime tests in CI + override two vulnerable dev transitives

[aaronjmars]

Follow-up to #63.

Runtime tests

CI was structural only — it greps built files and never executes a tool call — so everything merged in #63 had no automated coverage. Two suites now run in the MCP job:

test-protocol.js drives the real server over stdio and SSE: cold tools/list returns fallback schemas → a fake extension registers over WebSocket → exactly one well-formed tools/list_changed arrives on both transports → re-list returns the extension's schemas → an unchanged re-register stays silent → disconnect notifies again.

test-connection.js loads the real background.js under stubbed extension globals (simulating Firefox MV2, the heartbeat path) and drives it against the real server: a replaced socket's close event must not clear the live connection's heartbeat, inflate the attempt counter, or arm a reconnect; a failed connect must increment attempts once, not twice; the reconnect must be one-shot rather than fixed-rate.

These were validated against the pre-fix code at aefab6a, where the connection suite fails 5 of its assertions. So they detect the regressions they describe rather than passing vacuously — which was the whole problem with the structure tests before #63.

They live in opendia-mcp because they need the server and the ws client, which are that package's dependencies; test-connection.js reads the extension source by path and does not import from that package. Neither ships to npm (the package's files list is server.js + README.md). npm test is now these suites plus the syntax check, replacing a stub that always exited 1.

Dependency overrides

Two high-severity Dependabot alerts, both development scope, both reached only through web-ext:

Package	Before → After	Advisory
brace-expansion (via multimatch → minimatch)	1.1.15 → 1.1.17	GHSA-3jxr-9vmj-r5cp
shell-quote (via fx-runner)	1.8.4 → 1.10.0	GHSA-395f-4hp3-45gv

Both are denial-of-service by input complexity in build tooling. Nothing reaches a user: web-ext is a devDependency and node_modules is not part of the extension bundle. Overrides rather than a plain bump because web-ext pins the vulnerable ranges transitively.

Verification

npm ci in sync, extension build + validate + structure tests pass, web-ext lint still 0 errors and the same 3 pre-existing warnings, and both new suites pass.