Apple Music MCP v0.20.2

Fixed

• Listing playlists timed out on large libraries. playlist(action="list") read five properties per playlist, each as its own Apple Event, so a 738-playlist library ran past the 30-second AppleScript deadline and the call could only report a timeout. All playlist properties are now read in one event; only the track count, which isn't a playlist property, is still read per playlist. 738 playlists: timed out → 12.5s. If one playlist can't give up a property (a cloud playlist mid-sync), the old per-playlist read is the fallback. Contributed by @JacopKane in #62.
• Playlist operations by name paid for the full listing too. When a name wasn't found through the API, resolving it read every playlist with its track count just to compare names, so add, remove, copy and rename by name hit the same timeout on large libraries. Resolution now reads names only, in one Apple Event.

Security

• Every GitHub Action is pinned to a full commit SHA, first-party ones included, and each workflow's token defaults to read-only with write access granted per job. Checkouts no longer keep the token in the git config.
• Releases carry a build-provenance attestation for the sdist and wheel (gh attestation verify <file> --repo epheterson/applemusic-mcp) and an SPDX SBOM as a workflow artifact.
• CodeQL (Python and Actions) and OpenSSF Scorecard now run on main and weekly. Dependabot is configured for security updates only.