Fix db-pull search-replace missing home-URL content

[jasperf]

Summary

db-pull/db_pull built its search-replace pair from wp option get siteurl alone. On Bedrock, siteurl carries the /wp core subdirectory (https://example.com/wp) while home doesn't (https://example.com) — and content (nav menus, post guids, the home option itself) is written against home, never siteurl. A search-replace keyed only on siteurl matched nothing in that content, exited 0, and the pulled site looked fine until someone clicked a menu link and landed back on production.

Found on demo.imagewize.com after a --multisite pull: every subsite's block-based Navigation menu, and several post guids, still pointed at https://demo.imagewize.com/... even though wp_blogs.domain/wp_site.domain (the #234 fix) were both already correct — this is a separate gap from that one, not a regression of it.

Changes

• scripts/backup/db-pull.sh — reads home alongside siteurl for both prod and dev; runs a second wp search-replace pass against the home pair whenever it differs from the siteurl pair, and a third against the http:// form of the production home when production is on https:// — pre-HTTPS content still links there, and neither other pass matches it. Both live in a new Step 6, inserted before the multisite domain fixup; later step numbers shift down by one.
• mcp-server/src/tools/dbPull.ts — same fix for the db_pull MCP tool. DbPullResult gains prodHome/devHome/homeSearchReplaceOutput/httpHomeSearchReplaceOutput.
• mcp-server/src/server.ts — tool reply now reports the home URLs and, for each extra pass that ran, its search-replace output.
• CHANGELOG.md — 5.24.4.

Scope

The home pass is skipped when home === siteurl for both prod and dev — a harmless no-op on non-Bedrock installs, avoided to save a redundant full-table scan.

Verification

• bash -n scripts/backup/db-pull.sh — clean.
• npx tsc --noEmit in mcp-server/ — clean, exit 0.
• go generate ./internal/catalog/... — no diff (this change touches script body only, not the @flag/@desc manifest header, so the generated catalog is unaffected).
• Ran the real db-pull.sh with stubbed trellis/ssh/wp for a Bedrock HTTPS multisite and a non-Bedrock HTTP single site: the first issues all three search-replace passes with --url; the second skips both extra passes and keeps step numbers contiguous.
• Applied the equivalent fix by hand against the live demo.imagewize.com network (network-wide wp search-replace for both the https:// and bare-http:// production-domain variants) and confirmed every subsite's Navigation menu now resolves to the local dev domain.