[grade=B] fix(DC-162 rev3): presence-based id detection, null-params rejection, boundary matrix

Judge r2 (grade C) — all 3 blockers + both polish items:

1. REQUEST-vs-NOTIFICATION by PRESENCE, never truthiness: validateJsonRpc
   uses hasOwnProperty('id'); id 0 and id '' are VALID request ids echoed
   back BY VALUE (strict-equality tested), id:null treated as a request
   under the documented error-id convention. mcp-core default branch fixed
   the same way (`if (id)` → hasOwnProperty — id 0 / '' unknown-method now
   answer -32601 with the id echoed instead of being swallowed as falsy).
   Routes' malformed-notification silence path also switched to
   presence-based detection (id:null + bad params → 400 envelope, not 204).

2. params:null REJECTED (-32600): contract is object-or-omitted ONLY
   (strict JSON-RPC; the old code's m.params !== null guard contradicted
   the documented contract). Boundary tests pin the policy.

3. Unknown-method boundary tests: id 0 → -32601 id:0, id '' → -32601 id:'',
   id null → -32601 id:null — asserted at BOTH layer levels (route).

Polish:
- 16-case TABLE-DRIVEN boundary matrix covering every allowed/rejected
  id/params combination incl. 202 vs 204 notification split.
- Verifier now probes writable /tmp up front (exit 73 + clear message if
  unavailable; documented requirement) instead of dying at mktemp.
- Verifier target count 57 → 73 (DC-162 suites) with the boundary table
  named in the assertion label.

Full DC-162 suite: 73 passed (route 50 + core 23). No transport/credential
semantics changed from rev2.

urn:ump:or2qqhcytp6lfzlyi7xru7hdqy3uar2hbjllsrrbxrbray3c5kpa

dashcaddy-api/src/mcp/mcp-core.js

@@ -501,10 +501,13 @@ function createMcpHandler({ handleTool, serverVersion }) {
       }
 
       default: {
-        if (id) {
+        // Presence-based id detection (judge r2): id 0 and '' are valid
+        // request ids and MUST get -32601 echoed back, never swallowed as
+        // "falsy ⇒ notification".
+        if (Object.prototype.hasOwnProperty.call(msg, 'id')) {
           return {
             jsonrpc: '2.0',
-            id,
+            id: msg.id,
             error: { code: -32601, message: `Method not found: ${method}` },
           };
         }