Reject unusable MCP process and HTTP transport values #518

🤖 Generated by the Agentic Engineer

Problem and evidence

The package gate accepts MCP transport values that native process and HTTP APIs refuse. Complete offline packages containing unusable process strings or HTTP header fields pass manifest validation, but the corresponding native API rejects them before a usable connection can exist.

Expected outcome

Validate supported process strings and HTTP header names/values at the transport boundary so a green package gate represents a configuration the consumer can use.

Acceptance criteria

• Reproduce acceptance through the actual package gate and refusal through native APIs without starting a server or making a network request.
• Reject embedded NUL in process command, arguments and environment fields.
• Validate HTTP header field names and values against their wire syntax.
• Preserve legitimate empty arguments/values, Unicode process strings, literal variable references and permitted header whitespace.
• Run MCP and manifest regression suites.

Rough size: S. Part of #223.