v1.0.28

[v1.0.28]

• Distinguish missing named references from existing vault items that are not
  exposed to the current project, with specific CLI and MCP recovery metadata.
• Keep default MCP secret tooling safe-by-default while documenting the explicit
  operator path for exposing existing vault items to a repo.
• Add release-blocking web dependency audit coverage and patch the vulnerable
  ws transitives in the private docs toolchain.
• Rotate download Worker release pins through secrets by default, avoiding
  route-aware Worker deploys unless explicitly requested.