fix(ci): commit missing post-build-shebang.mjs + re-arm watcher on profile switch

- .gitignore: add packages/mcp-server/scripts/ to allowlist (blanket * rule was
  excluding the scripts dir, so post-build-shebang.mjs was never tracked)
- post-build-shebang.mjs: add the missing script that CI was failing on
  (Cannot find module: post-build-shebang.mjs across all 8 matrix jobs)
- DashboardProvider: track daemonStatusWatchedProfile so ensureDaemonStatusWatch()
  re-arms when the active profile changes (addresses P2 review comment)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: A.R.

.gitignore

@@ -56,6 +56,8 @@
 !packages/mcp-server/
 !packages/mcp-server/src/
 !packages/mcp-server/src/**
+!packages/mcp-server/scripts/
+!packages/mcp-server/scripts/**
 !packages/mcp-server/test/
 !packages/mcp-server/test/**
 !packages/mcp-server/package.json

packages/extension/src/webview/DashboardProvider.ts

@@ -122,6 +122,7 @@ export class DashboardProvider implements vscode.WebviewViewProvider {
   private onMcpServerDefinitionsChanged?: () => void;
   private daemonEventsAbort: AbortController | null = null;
   private daemonStatusWatcher: fs.FSWatcher | null = null;
+  private daemonStatusWatchedProfile: string | null = null;
   // v0.8.5: deps factory injected from extension.ts so the auto-regen hook
   // on `postStaleness` can reuse the live ApplyIdeConfigDeps without pulling
   // the daemon runtime singletons into the webview module.
@@ -2094,17 +2095,20 @@ export class DashboardProvider implements vscode.WebviewViewProvider {
         // File may not exist yet (daemon not started). Re-arm on next refresh.
         this.stopDaemonStatusWatch();
       });
+      this.daemonStatusWatchedProfile = profile;
     } catch {
       // daemon-status.json doesn't exist yet — watcher will be re-armed
       // the next time refresh() is called (startDaemonStatusWatch is called
       // from refresh() → ensureWatcher() path below).
       this.daemonStatusWatcher = null;
+      this.daemonStatusWatchedProfile = null;
     }
   }
 
   private stopDaemonStatusWatch(): void {
     this.daemonStatusWatcher?.close();
     this.daemonStatusWatcher = null;
+    this.daemonStatusWatchedProfile = null;
   }
 
   /**
@@ -2115,9 +2119,9 @@ export class DashboardProvider implements vscode.WebviewViewProvider {
   private ensureDaemonStatusWatch(): void {
     const profile = getActiveName() ?? "default";
     const statusFile = getProfilePaths(profile).daemonStatus;
-    // Re-arm if watcher is null (never started, file missing at last attempt,
-    // or profile changed). A live watcher needs no action.
-    if (!this.daemonStatusWatcher) {
+    // Re-arm when: watcher never started, file was missing last time, or
+    // the active profile has changed since the watcher was last started.
+    if (!this.daemonStatusWatcher || this.daemonStatusWatchedProfile !== profile) {
       if (fs.existsSync(statusFile)) {
         this.startDaemonStatusWatch();
       }

packages/mcp-server/scripts/post-build-shebang.mjs

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+/**
+ * Post-build shebang injection for dist/cli.mjs.
+ *
+ * tsup intentionally omits shebang from bundled output because a shebang in
+ * source files trips vitest/esbuild during test imports.  However, the npm
+ * package.json `bin` field points directly at `dist/cli.mjs`; on POSIX npm
+ * creates a symlink (not a wrapper script), so the kernel needs the shebang
+ * to exec the file directly.
+ *
+ * This script prepends `#!/usr/bin/env node` and ensures the file is
+ * executable (0o755).  It is a no-op on Windows where the kernel ignores
+ * shebangs and npm uses `.cmd` wrappers anyway.
+ */
+import { readFileSync, writeFileSync, chmodSync, existsSync } from "node:fs";
+import { join } from "node:path";
+
+const file = join(import.meta.dirname, "..", "dist", "cli.mjs");
+if (!existsSync(file)) {
+  console.error("post-build-shebang: dist/cli.mjs not found");
+  process.exit(1);
+}
+
+const content = readFileSync(file, "utf8");
+if (content.startsWith("#!/usr/bin/env node")) {
+  console.log("post-build-shebang: already present, skipping");
+  process.exit(0);
+}
+
+writeFileSync(file, "#!/usr/bin/env node\n" + content);
+chmodSync(file, 0o755);
+console.log("post-build-shebang: injected shebang + chmod 755");