fix(mcp): CORS-aware scaffold, cors.wildcard rule, server-not-appended FP; v1.1.2

internal/rules/rules.go

@@ -268,19 +268,15 @@ var registered = []Rule{
 			if !c.Importing("einherjar/web/server") || !c.Importing("einherjar/core/launcher") {
 				return nil
 			}
-			if !c.Called(".Append") {
+			// Fire only when a server is constructed but never appended — an appended
+			// server (lc.Append(srv)) is correctly managed, so stay silent (no false positive).
+			if !c.Called("server.New") || c.Called(".Append") {
 				return nil
 			}
-			// Heuristic: warn if server.New is constructed but not appended via .Append.
-			// We can't statically prove the argument was the server, so this is informational.
-			if c.Called("server.New") {
-				return []Finding{{
-					Severity: SeverityInfo,
-					Message:  "web/server is constructed — ensure it is passed to launcher.Append() so its lifecycle is managed",
-					Hint:     "lc.Append(srv) lets the launcher start and gracefully stop the HTTP server",
-				}}
-			}
-			return nil
+			return []Finding{{
+				Message: "web/server constructed but never appended to the launcher — its lifecycle won't be managed",
+				Hint:    "lc.Append(srv) so the launcher starts and gracefully stops the HTTP server",
+			}}
 		},
 	},
 }