0.5.4 — reviewable as a desktop extension

The release that makes AnkusDrive reviewable as a desktop extension. Every one of the
281 tools now says what it is and whether it can change your work, so clients can run
the read-only ones unasked and confirm the rest; the package ships a privacy policy
backed by an audit that found no network access in its code; and the .mcpb carries
both, which Anthropic's extension directory requires. Two capabilities arrive with it:
a Blender studio backend for photoreal renders, and a container backend for the
OpenFOAM-backed solver families.

Added

• Every MCP tool now carries a display title and behaviour hints (readOnlyHint,
  destructiveHint, openWorldHint: false), so clients can auto-approve the 143
  read-only tools and ask before the 46 that may change or remove existing state
  (closing documents, overwriting files, editing objects, run_script). The
  classification lives in one registry, ankusdrive/tool_annotations.py, with each
  destructive mark's reason. The server refuses to import with an unclassified tool,
  and a fast-lane test fails a read-only tool whose handler visibly mutates
  (#368).
• PRIVACY.md, plus a README Privacy Policy section and privacy_policies in the
  MCPB manifest. AnkusDrive collects nothing and its code makes no network requests;
  the policy lists exactly what is stored locally and where
  (#368).
• A Blender (Cycles) backend for render_photoreal: assemblies with per-part
  appearance (the 14 Render card names or a neutral PBR dict), a studio scene
  (cyclorama plus key/fill/rim/top lights scaled to the model), quality draft /
  preview / final with OIDN denoising, GPU device auto-selection with CPU fallback,
  and a .blend alongside the PNG for refinement in Blender. Blender is discovered
  like a solver (ANKUSDRIVE_BLENDER_PATH, PATH, per-OS dirs), reported by
  setup_status / render_capabilities with an install hint, and installable with
  scripts/install-renderers.sh blender / install-solvers.ps1 blender
  (#357).
• A container substrate for the OpenFOAM-backed families: ANKUSDRIVE_SUBSTRATE
  = native | wsl | multipass | container, with docker / podman / nerdctl via
  ANKUSDRIVE_CONTAINER_ENGINE. Unset keeps each OS's existing default; an invalid
  selection raises a named error rather than silently defaulting. See
  docs/CONTAINER_SUBSTRATE.md (#366).

Fixed

• solve_capabilities, setup_status and doctor reported openEMS, Bempp and KrakenOS
  as absent on installs where the worker actually runs them: discovery checked the
  module in its own process, not the dedicated interpreter the solve uses. One
  resolver, solvers.solver_python, now probes each candidate interpreter in a child
  process (find_spec only, so the GPL boundary holds) and is shared by discovery and
  the worker (#353).
• The release's .mcpb.sha256 named dist/ankusdrive-<version>.mcpb, so
  sha256sum -c beside a downloaded bundle failed; it now names the bare filename
  (#355).

Changed

• render_photoreal's default renderer is now "auto" (was "Povray"): Blender,
  else POV-Ray, else any add-on renderer, reported as auto_selected
  (#357).
• The mcp floor rises from 1.2 to 1.10, the first release whose FastMCP tools
  carry a title. Below it the annotations would be silently dropped
  (#368).