release(mcp): cut post-0.2.0 MCP package update

[JSONbored]

Parent roadmap: #82

Background

The published npm package is still @jsonbored/gittensory-mcp@0.2.0, but several post-release changes now affect MCP behavior, API compatibility, package-facing docs, security boundaries, signal surfaces, and local diagnostics. Users installing the public package should not lag behind the live API contract.

Goal

Prepare and cut the next MCP package release through the trusted publishing path, choosing 0.2.1 for patch-only changes or 0.3.0 if merged changes expose new public commands, tools, or response shapes.

Current Behavior

The live repo has moved beyond the last MCP tag. Package consumers can install 0.2.0, but may miss newer fixes or MCP/API compatibility changes.

Desired Behavior

The npm package, GitHub Release, package changelog, package README, and live API compatibility metadata all agree on the current supported MCP version.

Implementation Requirements

• Audit commits after mcp-v0.2.0 for package-visible changes.
• Decide 0.2.1 vs 0.3.0 based on public CLI/tool/schema impact.
• Move the MCP changelog content out of Unreleased into the real target version section.
• Update packages/gittensory-mcp/package.json only after the version decision is made.
• Run package dry-run, tarball allowlist, secret scan, CLI smoke, and provenance readiness checks.
• Tag with strict mcp-vX.Y.Z only after all release gates pass.
• Publish through npm trusted publishing, not an npm token.
• Verify npm dist-tags, package page, GitHub Release, and package README rendering after publish.

Public/Private Output Boundaries

Release notes may mention private MCP/API scoreability surfaces, but must not include local paths, secrets, tokens, wallet/hotkey data, raw trust scores, or payout claims.

Acceptance Criteria

• A release issue checklist records the version decision and validation results.
• npm view @jsonbored/gittensory-mcp version returns the new version after release.
• The GitHub Release exists for the matching mcp-vX.Y.Z tag.
• Package changelog has a real version section, not only Unreleased.
• Packed tarball includes only intended package files.
• CLI smoke covers doctor, status, whoami, agent plan, agent packet, preflight, and --stdio.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally to avoid CI variance.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, queue pressure, source-upload safety, public/private boundaries, or upstream drift.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.
• MCP/local tooling must prove source contents are not uploaded.

Additional Test Scenarios

• Package dry-run includes README, LICENSE, CHANGELOG, bin/lib/scripts, and package metadata only.
• gittensory-mcp doctor reports compatible API/package state.
• Source upload guard still fails closed.
• Release workflow rejects mismatched tag/package versions.