Fix update identity, FME auth, and disabled resource crashes

[cursor]

Description

Fixes three high-impact regressions found while auditing recent commits:

• Prevent normalized update bodies from carrying an identifier that conflicts with the confirmed resource_id/URL/params target, avoiding wrong-resource mutations for connector/service/environment-style updates.
• Preserve caller-provided FME auth case-insensitively and strip all x-api-key casing variants before requests to api.split.io, avoiding auth override or credential leakage.
• Make pipeline/execution MCP resources tolerate filtered toolsets by returning empty/unavailable resource payloads instead of crashing discovery or direct reads.

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation
• Other

Checklist

• Tests pass
• Typecheck passes

Validation performed:

• pnpm test -- tests/client/harness-client.test.ts tests/tools/tool-handlers.test.ts
• pnpm test -- tests/resources/pipeline-yaml.test.ts tests/resources/execution-summary.test.ts
• pnpm build && pnpm docs:generate && pnpm typecheck && pnpm test

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}