Framework 0.12 adoption and supply-chain hardening
- Adopt @cyanheads/mcp-ts-core ^0.12.3 (MCP SDK v2): HTTP endpoints serve protocol revision 2026-07-28 beside 2025-era clients, tool inputs reject unknown keys, and the advertised output schema declares the error envelope
- tmdb_discover_titles region_required failures map to ValidationError; upstream 404s on detail lookups log at debug
- Retries honor upstream Retry-After; fetch timeouts classify as Timeout again
- Supply-chain install guard: 3-day release-age hold plus Socket scanner
- Docker image on Bun 1.4.0 with a native-arch build stage and optional peers dropped from production
- .mcpb bundles strip platform-specific native bindings
- devcheck adds floating-dependency-specifier and plugin-manifest gates
- Security policy, funding config, and .gitattributes; agent protocol docs and skills synced
- deps: @cyanheads/mcp-ts-core ^0.10.6 -> ^0.12.3 (+ TypeScript ^7.0.2, Biome 2.5.9)