Harden catalog runtime handling

[heznpc]

Summary

• enforce catalog timeout across fetch and JSON body parsing
• reuse fallback catalog during retry backoff to avoid repeated remote calls
• split MCP tool dispatch so unknown tools fail before catalog fetch
• expand MCP smoke and packed-package import verification

Validation

• npm test
• npm run build
• npm run smoke:mcp
• npm run pack:check
• npm audit --audit-level=high
• npm exec -- license-checker-evergreen --failOn "GPL-2.0;GPL-3.0;AGPL-3.0"
• node dist/bin.js help
• git diff --check