v0.1.16: @cyanheads/mcp-ts-core 0.10.14 + Socket supply-chain guard

@cyanheads/mcp-ts-core 0.10.14 + Socket supply-chain guard

Framework maintenance plus a version-drift fix: SERVER_VERSION now derives
from package.json instead of a stale hardcoded literal.

Added:

• @socketsecurity/bun-security-scanner wired via [install.security] in
  bunfig.toml — scans every package for malware, typosquats, and CVEs
  before install
• minimumReleaseAge install guard — 3-day hold on freshly published
  versions; @cyanheads/mcp-ts-core excluded via minimumReleaseAgeExcludes
• .github/SECURITY.md, .gitattributes

Changed:

• Dockerfile: oven/bun:1.3 → 1.3.14 pin (both stages), build-stage
  --ignore-scripts, BuildKit cache mounts for the install cache
• package.json identity: author normalized, packageManager → bun@1.3.14

Fixed:

• SERVER_VERSION now derives from package.json instead of a hardcoded,
  drifted literal that leaked into outbound User-Agent headers
  (#28)

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.9 → ^0.10.14
• @biomejs/biome ^2.5.0 → 2.5.2
• @types/node ^26.0.0 → 26.1.0
• tsc-alias ^1.8.17 → ^1.9.0
• vitest ^4.1.9 → ^4.1.10
• Transitive advisories on js-yaml, hono, vite cleared — bun audit clean

145 tests pass; bun run devcheck clean.

CHANGELOG v0.1.16