release: promote TypeMCP 0.2.2 examples remediation

[sjungwon03]

Summary

Promote the reviewed TypeMCP 0.2.2 examples dependency remediation from dev to release-only main.

• Exact source: db7088f3b4e820f2a1083255c779efdf65875ad6
• Removes the obsolete local override and locks the application to published TypeMCP 0.2.2.
• Production graph: TypeMCP 0.2.2 → MCP SDK 1.30.0 → Hono node server 2.0.12.

Required release proof

• Exact-head verification and release-promotion checks
• Independent approval and no unresolved threads
• Canonical main clean reinstall, production audit, and runnable-example smoke

Closes #8

[sjungwon03-ai]

Code Review — APPROVE

Clean release-promotion PR that advances the TypeMCP 0.2.2 dependency remediation from dev to main.

Summary

• Locks the production graph to published @theorvane/type-mcp@0.2.2 → @modelcontextprotocol/sdk@1.30.0 → @hono/node-server@2.0.12 with pinned versions in the lockfile.
• Adds npm run audit:prod to both the check script and the existing verify CI workflow.
• Introduces a dedicated release-promotion.yml workflow scoped to PRs targeting main from dev, with least-privilege contents: read permissions.
• Adds a Vitest guard (test/dependency-security.test.ts) that asserts exact lockfile versions, preventing accidental regressions to overrides.
• README updated to document the dependency-security boundary.

Verdict

No code-quality blockers. CI (verify) passes on the current head. Merge-conflict state is informational only and does not affect this assessment.

[sjungwon03-ai]

Independent release-promotion review at exact head db7088f.

Two governance blockers:

1. Required status check release-promotion is absent at this head — only a stale run exists for 3155e9c. The main-release ruleset requires both verify and release-promotion green at the merged head.
2. PR conflicts with main (diverged: main carries releases #1 and #5 that dev lacks). Back-merge/rebase dev onto main and re-verify before promotion.

Otherwise verified clean: exact-head lineage from approved PR #7, in-scope diff only, TypeMCP 0.2.2 -> MCP SDK 1.30.0 -> Hono node-server 2.0.12 consistent across package.json, lockfile, and npm registry, no local overrides, README accurate, verify green, no unresolved threads.

[sjungwon03-ai]

Required release-promotion check has not run at head db7088f (only a stale run for 3155e9c). Re-trigger so the ruleset-required check passes at the exact head.

[sjungwon03]

Superseded: PR #11 was squash-merged and therefore did not preserve the main parent relationship required to resolve this release conflict. A new merge-commit reconciliation PR will make main an ancestor of dev, then a fresh exact-head release-promotion PR will be opened with new checks and review.