resolveShorthand silently ignores all but the first shorthand key #389

Summary

A component may declare more than one shorthand key. resolveShorthand
(Sources/mcs/ExternalPack/ExternalPackManifest.swift:714-760) is a chain of
if shorthand.contains(...) { return ... }, so only the first match in declaration order wins and
every later key is dropped with no warning.

Reproduction

- id: my-tool
  description: Example
  brew: my-tool
  mcp: { command: my-tool, args: [serve] }

brew is checked first, so this installs the Homebrew package and never registers the MCP
server. mcs pack validate reports nothing, so the pack looks correct to its author and the
missing server only surfaces as "the MCP server isn't there" long after the fact.

The order is fixed by the function body (brew, mcp, plugin, shell, hook, command,
skill, agent, settingsFile, gitignore), not by the order the keys appear in the YAML, so
which key survives is not something the author can predict from their own file.

Root cause

A component has exactly one installAction, so declaring two shorthands is always an authoring
error — but nothing says so. resolveShorthand returns the first ResolvedShorthand it can build
and the decoder never revisits the container.

Suggested fix

A PackHeuristics check that counts how many shorthand keys a component declares and reports
.error when it is more than one, naming the keys found and which one currently wins.
ExternalComponentDefinition.ShorthandKeys already enumerates them, so the check can iterate the
enum rather than hard-coding a list.

.error rather than .warning seems right: ValidatePackCommand exits non-zero only on errors,
and this is never a deliberate choice.

Follow-up to #388, where this was noticed.