fix(mcp): route assemble-npm output to stderr to keep stdout protocol-safe (#225)

[SAY-5]

Summary

Fixes #225. The tnmsm binary's primary mode is the MCP stdio server, where stdout is reserved for JSON-RPC framing. The hidden assemble-npm build subcommand was using println! to log copied paths, which writes to stdout — protocol-unsafe if the binary is ever invoked from a wrapped/redirected MCP context.

Change

mcp/src/commands/package.rs:45 — switch println!(\"Hydrated …\") to eprintln!. The error path on :50 was already eprintln. CLI users running tnmsm assemble-npm interactively still see the messages; the stream just changes from fd 1 → fd 2.

Test plan

• cargo build --manifest-path mcp/Cargo.toml — clean
• No behavior change for users running the subcommand interactively (terminals show stderr)
• Stdout now contains zero non-JSON-RPC bytes from this subcommand

[TrueNine]

Merged into dev via cherry-pick. The PR base was changed from main to dev, which caused conflicts because dev had diverged significantly. All commits have been cherry-picked onto dev and pushed. Thanks for the contributions!

[TrueNine]

Thank you for the contribution! All commits have been cherry-picked and merged into the dev branch. 🙏