Reject malformed remote MCP header declarations #415

🤖 Generated by the Agentic Engineer

Problem

Remote headers supplied as an array pass the package gate. A declared connection can be published with unusable authentication header configuration.

Proposed direction

Validate optional named string header maps for remote definitions without evaluating their contents.

Acceptance criteria

• Reject non-object headers and nonstring values.
• Preserve valid literal headers and variable references.
• Do not launch or contact a server during validation.

Reproduced on current main before implementation. Rough size: S.