新增MCP stdio传输安全验证机制，防止命令注入攻击

Editor assessment

This commit patches CVE-2026-22688. The subject announces a new security validation mechanism for MCP stdio transport aimed at preventing command injection, naming both the subsystem and the threat. It is a single line with no body, no scope beyond the implied MCP transport, and no footer such as an advisory reference. The `feat` type fits the introduction of new validation code, though a `fix` framing would have signaled the security intent more directly. Because command-injection defenses need context on what inputs were previously trusted, the missing explanation is a genuine loss rather than acceptable brevity. Readable and valid, but the message stops at a headline.