fix: reject non-array tools in static manifests

[Gambit-Checkmate]

What & why

A static manifest such as {"tools":"MCP001"} currently reaches the rule engine as a string instead of a tool list. Reject non-array tools values during normalization, with an error naming the manifest, before the audit runs.

Closes #25.

Changes

• Validate the tools collection before constructing an audit target.
• Cover strings, objects, numbers, and booleans; preserve the existing empty-list behavior for omitted or null tools and support for a bare tool array.
• Add an Unreleased changelog entry.

Checklist

• Focused change with a clear description
• Ran lint / tests / build (npm run lint, npm test, npm run build; no formatter is configured)
• Updated CHANGELOG
• Linked the related issue

Validation on Windows with Node.js 24.15.0: all four new invalid-type cases failed on the unfixed code. With the fix, all 76 tests pass, including the stdio integration suite; typechecking, compilation, and git diff --check also pass.

AI assistance was used to prepare this contribution and run the checks above.

[github-actions]

Welcome, @Gambit-Checkmate, and thanks for your first pull request to MCP-audit.

A quick look at CONTRIBUTING.md covers how things are set up and run here.

I'll review this shortly. Ask anything in the thread if something is unclear.

[github-actions]

And it's in. Thanks @Gambit-Checkmate.

MCP-audit gets better every time someone outside the repo digs in like this.

If you find MCP-audit useful, consider dropping a star. It helps more people find it.

Happy to see more from you whenever you have the time.