feat(mcp)!: harden contracts and evidence references

BREAKING CHANGE: comparison tools now require session-owned Evidence IDs or approved bundle paths, and structured Evidence results use compact references.

src/application/JavaScriptRuntimeReconciliationService.ts

@@ -6,6 +6,7 @@ import {
   type AnalysisError,
 } from "../domain/errors.js";
 import type { Evidence } from "../domain/evidence.js";
+import { projectInputIssues } from "../domain/inputIssueProjection.js";
 import { reconcileJavaScriptRuntime } from "../domain/javascriptRuntimeReconciliation.js";
 import { reconcileJavaScriptRuntimeInputSchema } from "../domain/javascriptRuntimeReconciliationSchemas.js";
 import { err, ok, type Result } from "../domain/result.js";
@@ -18,7 +19,14 @@ export const reconcileJavaScriptRuntimeEvidence = (
   rawInput: unknown,
 ): Result<Evidence, AnalysisError> => {
   const parsed = reconcileJavaScriptRuntimeInputSchema.safeParse(rawInput);
-  if (!parsed.success) return err(new AnalysisInputError(OPERATION));
+  if (!parsed.success)
+    return err(
+      new AnalysisInputError(
+        OPERATION,
+        undefined,
+        projectInputIssues(parsed.error.issues, rawInput),
+      ),
+    );
   try {
     const result = reconcileJavaScriptRuntime(parsed.data);
     return ok(