[devin-ai-integration]

What and why

Clears the SonarCloud findings on develop across the scripts and packaging helpers:

• shelldre:S131 in scripts/install-mcp-publisher.sh: the architecture case states its default (any other machine name is looked up as uname spells it).
• shelldre:S7679 x3 in scripts/npm-publish-missing.sh: manifest names its parameter instead of reading $1 three times.
• javascript:S4624 in scripts/mcp-stdio-probe.mjs: the nested template literal is a named value.
• javascript:S6582 in packaging/npm/sysml-mcp/lib/platform.js: optional chaining for the error code.
• python:S1192 in client/python/scripts/check_version.py: package.json is one constant.

The two shell:S6506 vulnerabilities in scripts/install-mcp-publisher.sh and scripts/mcp-registry-publish.sh and the text:S8564 lock-file finding on packaging/npm/sysml-mcp/package.json are already fixed on develop and leave the next scan. No behaviour change, no changelog fragment.

Deferred from this group: java:S3776 and java:S127 x3 in scripts/pilot-json-exporter/ExportJSON.java, which #1328 edits; they land after that PR.

A pull request gets no SonarCloud analysis (the CircleCI scan job runs on develop and main only); the proof that these findings clear is the post-merge scan of develop.

How it was verified

shellcheck over both scripts is clean; node --check over both JavaScript files; npm test in packaging/npm/sysml-mcp (23 tests) and pytest client/python/tests/test_check_version.py (85 tests) pass; go test ./tests/hygiene passes; make lint passes. The SonarCloud analyzer run over each edited file reports no finding.

Checklist

• make test and make lint pass locally
• Tests added or updated for the change
• Documentation extended where it already covers the surface (see CONTRIBUTING.md)
• Changelog entry added as changes/unreleased/<slug>.<section>.md, not as an edit to CHANGELOG.md
• baselines regenerated and make docs-counts run if a gate count moved (compliance rows need nothing: the census is counted at docs build)
• No internal work-item labels (waves, slices, F4, K5) in the body, docs, or changelog

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/c2b1ac4ad6de4d8788e78fd86c7c1729
Open in Devin Desktop: https://nasa-jpl-demo.devinenterprise.com/desktop/session/c2b1ac4ad6de4d8788e78fd86c7c1729?variant=devin
Requested by: @HuiJun

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.