Add missing regression tests for MCP hot-load fail-closed gates that never landed from #330, plus persisted message content parsing from this week's extract.

Risky behavior now covered

• MCP tool identity: colliding tool names from different servers remap to _2/_3 instead of overwriting each other, and a failed multi-server refresh closes only the connections created in that attempt.
• MCP cancellation ownership: abort after dispatch waits for the in-flight tool to settle so task termination cannot commit early; extra keys and overlong search queries fail before the catalog loads; non-executable catalog entries are skipped.
• Agent profiles: invalid ids, unknown roles/scopes, extras, and malformed workspace:/global: refs fail closed; allowlists are trimmed and deduped.
• Marketplace parse: invalid JSON, extras, malformed sha256: hashes, and ./../ / absolute source paths are rejected before install.
• Skills vs plugins install scopes: skills accept only project|global; plugins accept only workspace|user. Marketplace add/remove and skill-improvement restore reject blanks and extras.
• Persisted message text: contentText trims strings, joins text/inputText parts, and ignores non-textual values so hydration/projection cannot invent transcript text.

Test files added/updated

• test/mcp.cache.test.ts (updated)
• test/mcp.deferred-tools.test.ts (updated)
• test/agent-profile-schema.test.ts (added)
• test/plugins.marketplace-parse.test.ts (added)
• test/jsonrpc.skills-plugins-marketplace-schema-rejects.test.ts (added)
• test/shared.message-content.test.ts (added)

Why these tests materially reduce regression risk

MCP hot-load, profile refs, and marketplace source paths are shared harness gates. A silent overwrite of colliding MCP tools, an early task-complete after abort, or a marketplace path that escapes its root would leak across sessions and clients. contentText is the single parser for persisted model-message content; a wrong join or fallback would corrupt snapshots and reconnect hydration. The new tests lock the fail-closed behavior without changing production code.

Validation

• Targeted coverage + platform-boundary: 49 tests green
• Touched files Biome-clean
• bun run check, bun run typecheck, bun run docs:check: clean
• Full bun run test: new files that reached the runner passed in-suite (agent-profile-schema, jsonrpc.skills-plugins-marketplace-schema-rejects). Isolated runs also passed for mcp.cache, mcp.deferred-tools, plugins.marketplace-parse, and shared.message-content.