fix: prevent fork bomb in TypeScript CLI when installed via npm

[Copilot]

When @atlassian/mcp-compressor is installed globally via npm, the mcp-compressor bin entry points back to dist/cli.js. The old candidateCoreBinaries() included the bare string "mcp-compressor" with a special-case that bypassed the existsSync guard, so the shim would spawn itself indefinitely.

Changes

• resolveFromPath(name) — resolves a bare binary name to an absolute path via PATH directories (with X_OK check); returns null if not found.
• isNativeExecutable(filePath) — reads the first 4 bytes and matches native magic numbers (ELF \x7fELF, PE MZ, Mach-O variants). A JS shim starting with #! returns false.
• candidateCoreBinaries() — replaces the bare "mcp-compressor" push with a resolveFromPath + isNativeExecutable guard; only the resolved absolute path is added when confirmed native.
• runRustCoreCli() — drops the binary !== "mcp-compressor" special-case; existsSync is now applied uniformly to all candidates.

// Before: always attempted, bypassing existsSync — spawns itself → fork bomb
candidates.push("mcp-compressor");
if (binary !== "mcp-compressor" && !existsSync(binary)) continue;

// After: only included when PATH resolves to an actual native binary
const resolved = resolveFromPath("mcp-compressor");
if (resolved !== null && isNativeExecutable(resolved)) candidates.push(resolved);
if (!existsSync(binary)) continue; // uniform for all candidates

[atlassian-cla-bot]

Thank you for your submission! Like many open source projects, we ask that you sign our CLA (Contributor License Agreement) before we can accept your contribution.
If your email is listed below, please ensure that you sign the CLA with the same email address.

The following users still need to sign our CLA:
❌Copilot

_{Already signed the CLA? To re-check, try refreshing the page.}