mcp-risk-inventory v0.1.0

Initial public release of MCP Risk Inventory.\n\n- Dependency-free Node 18 CLI with mcp-risk bin.\n- Composite GitHub Action for SARIF/CI scans.\n- Static checks for local MCP execution, unpinned package launchers, secret exposure, broad filesystem grants, remote endpoints, tool schema drift, and unknown registries.\n- npm package metadata is prepared, but npm registry publishing is pending npm credentials in the release environment.