Malformed disabledRules shape is silently ignored #22

Problem

{"disabledRules": "MCP001"} (string instead of array) is silently ignored and all rules run. A user who thinks they disabled a rule gets a false sense of coverage.

Where

src/config.ts (normalizeConfig: only handles Array.isArray(obj.disabledRules)).

Acceptance

Add a failing test first asserting normalizeConfig({disabledRules: "MCP001"}) throws. Then fix.