OpenVAS-MCP 0.2.2

OpenVAS-MCP v0.2.2

OpenVAS-MCP v0.2.2 is the first complete release of the Rust gvm-mcp server
published through the rust-gvm release model, and the first usable one since
v0.1.0: the v0.2.0 tag was never published because its release run was stuck
on a retired macOS runner, and v0.2.1 was published without assets because the
repository's immutable-releases setting rejected the uploads. It brings the
tool surface to the rust-gvm-api 0.5.0 contract and forwards each caller's
gvmd identity instead of holding one session of its own.

Deployments upgrading from v0.1.0 should review the
installation guide
and the
authentication guide.
The container image moved to ghcr.io/greenbone-hive/openvas-mcp and is
published only under the immutable release tag, the binary archives are now
named per platform (gvm-mcp-linux-amd64.tar.gz and so on), and GVM_USERNAME
/ GVM_PASSWORD are a fallback identity that HTTP callers may replace with
their own Authorization header (--require-caller-auth enforces that).

Highlights:

• 194 tools in 25 toolsets covering 195 of the 199 operations of the
  rust-gvm-api 0.5.0 contract (gvmd 26.43.0 / GMP 22.8), with
  scripts/gateway_sync_check.py keeping the mapping in sync in CI;
• per-request identity forwarding to the gateway, job-bound sessions for
  report exports, and --require-caller-auth / --allowed-hosts hardening
  for streamable-HTTP deployments;
• restructured documentation: a short README plus separate installation,
  toolsets, authentication, usage and development guides;
• refreshed dependencies clearing the open RustSec advisories, and a config
  test that no longer writes to the shared temporary directory;
• release automation aligned with rust-gvm: a reviewed version PR, the
  pontos-driven Orchestrated Release workflow, and a tag-triggered
  Release workflow that qualifies the tag against protected main;
• release binaries for five targets (Linux amd64 glibc and musl, Linux arm64,
  macOS amd64 and arm64), each with a SHA-256 checksum;
• the Linux amd64/arm64 image at ghcr.io/greenbone-hive/openvas-mcp:v0.2.2
  (no moving latest tag);
• CycloneDX JSON and XML SBOMs, an SBOM quality report, checksums, and
  Sigstore provenance for downloadable artifacts and the container image.

The release artifacts are built from the immutable v0.2.2 tag and verified
against its exact qualified protected-main commit before publication completes.