Replace logrus with slog for Wasm compatibility (COG-42)

[devin-ai-integration]

Closes: COG-42

Replaces the github.com/sirupsen/logrus dependency with Go's standard library log/slog. Logrus is in maintenance mode and does not compile for GOOS=wasip1 GOARCH=wasm targets. slog (available since Go 1.21) is a drop-in replacement that enables Wasm compilation.

Changes

• internal/ghmcp/server.go: Replace logrus.New() with slog.New(slog.NewTextHandler(...)). The stdLogger for SetErrorLogger now writes directly to the same io.Writer instead of through logrusLogger.Writer().
• pkg/log/io.go: Change IOLogger to accept *slog.Logger. Log calls switch from Infof format strings to structured Info with key-value pairs.
• pkg/log/io_test.go: Update test logger setup to use slog.NewTextHandler.
• go.mod/go.sum: Remove logrus dependency.
• third-party-licenses.*.md: Remove logrus license entry.

Tradeoffs

• IOLogger output format changes from "[stdin]: received 15 bytes: data" to structured msg="[stdin]: received bytes" count=15 data="data". This is idiomatic slog but is a visible format change in command logs.
• stdLogger (used by SetErrorLogger) previously wrote through logrus's formatting pipe; it now writes directly to the same output. The mcp-go SetErrorLogger API only requires *log.Logger, which is unaffected.

Human review checklist

• Verify the stdLogger change in server.go:218 — it now uses logOutput directly instead of logrusLogger.Writer(). This means error log lines won't pass through a structured formatter. Confirm this is acceptable.
• Confirm the structured log format change in io.go Read/Write methods won't break any log consumers.
• Check that log level defaults match: Info by default, Debug when LogFilePath is set.

Link to Devin run: https://app.devin.ai/sessions/08a4736398424f3b90dc017d6a5ac9f4
Requested by: @ShawnAzman

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.