Fix hyphenated tool paths in artifacts

[GijungKim]

Summary

Serialize non-identifier artifact tool-path segments with JSON-string bracket notation and accept the same mixed dot/bracket grammar at the MCP host boundary. Artifact binding extraction now recognizes bracketed integration roots while preserving the single-call execute-action security contract.

Linked issue

Fixes #1882

Verification

• bun run format:check
• bun run lint
• bun run typecheck
• bun run test - both affected package suites passed (@executor-js/host-mcp: 219 tests; @executor-js/mcp-apps-shell: 84 tests before adding the new focused browser case). The full monorepo fan-out hit unrelated resource-sensitive failures in stdio/auth/database tests; every reported failure passed immediately in isolation.
• e2e - mcp-app.browser.test.ts: serializes a hyphenated integration slug with bracket notation passed in local headless Chrome; no trace was recorded.

Checklist

• Added .changeset/artifact-hyphenated-tool-paths.md.
• Added grammar, binding, host-resolution, and browser regression coverage.
• No secrets, credentials, or private data in the diff.