v0.3.1 - all three channels publish themselves

Release automation is now complete: a single gh release create publishes to GitHub, PyPI, and the MCP Registry, with no credential to mint, expire, or store anywhere.

PyPI has published itself since 0.2.0 via Trusted Publishing. The registry step was still manual — mcp-publisher login github mints a device-flow token that lives about an hour, so every release meant repeating a browser device-code dance. It expired mid-release twice while shipping 0.2.x.

The new registry job uses mcp-publisher login github-oidc, exchanging the workflow's OIDC token for a registry JWT. The repository owner must match the io.github.<owner>/* namespace in server.json. Same trick as PyPI Trusted Publishing, same benefit: nothing to leak.

It runs after PyPI rather than beside it — the registry entry points at the published package, so listing a version PyPI doesn't have yet would leave a broken entry.

Also guarded

server.json carries the version in two places (top-level and packages[].version). A release where those disagreed is the likely cause of the phantom "duplicate" that blocked the 0.1.1 registry publish months ago. CI now fails the release if either disagrees with the tag.

No functional changes to the server itself — 0.3.0's mcp 1.x/2.x support and 0.2.0's batching are unchanged.