fix(mcp): support pnpm global shim with separate node runtime

[ordinary-s]

Fixes #6370

Root cause:
DBX MCP discovery only searched MCP package bound to selected Node runtime and ignored valid pnpm global shims from separate PNPM_HOME.

Solution:
Resolve PATH shims safely by validating package identity and Node compatibility before launching.

Testing:

• Added regression test for split PNPM_HOME layout
• Existing MCP tests pass

[t8y2]

The real pnpm global-shim path is still not supported by this implementation.

node_script_from_launcher() accepts a direct JavaScript file or a launcher containing the custom # cmd-shim-target= marker, but standard pnpm shims do not contain that marker. A clean pnpm 10.27.0 global install of @dbx-app/mcp-server@0.4.66 produces a normal POSIX shell shim; pnpm's cmd-shim implementation likewise produces standard shell, .cmd, and PowerShell launchers. Those files are rejected by the current parser, so the original split PNPM_HOME case still resolves to [dbxMcpMissing]. The new test only constructs a synthetic launcher with the private marker and therefore does not reproduce pnpm output.

The same discovery result also needs to drive status, version reporting, update, and uninstall. Currently the PATH shim can make status appear installed while script_path and version remain missing, update targets the unrelated Node runtime, and uninstall refuses because that runtime does not own the package.

Please use real pnpm-generated POSIX/Windows fixtures and implement one safe, shared discovery result for launch, status, update, and uninstall. Keep the existing package-identity, path-containment, and Node-engine checks.