Run the MCP App test in CI

`npm test` picked up test:app, but CI lists its steps individually, so the new
suite never ran there — and it is the only thing guarding the rules that fail
silently in a host: no external asset under the deny-by-default CSP, no inline
event handlers, the size tripwire against a second SDK copy landing, and the
resource MIME type matching the ext-apps constant.

Author: fmadore

.github/workflows/ci.yml

@@ -64,6 +64,9 @@ jobs:
       - name: Fixture MCP round-trip (offline)
         run: npm run test:fixture
 
+      - name: MCP App bundle (offline)
+        run: npm run test:app
+
       - name: HTTP transport round-trip (offline)
         run: npm run test:http