fix: handle null MCP asset input

[konkonrong-lgtm]

What does this PR do?

Handles null JSON input passed to sf agent mcp asset replace --assets.

Previously, null was successfully parsed as JSON and the command attempted to access .assets on it, resulting in a raw TypeError:

Cannot read properties of null (reading 'assets')

This change uses safe property access so invalid input falls through to the existing InvalidShape validation.

A regression test was added for --assets null.

Test results:

• yarn test:only — 448 passing
• yarn build — successful

What issues does this PR fix or reference?

Fixes forcedotcom/cli#3625