Pin undici to ^7.25.0 — the silent bump to v8 required Node >=22.19 and
was breaking the Node 20 CI matrix (markAsUncloneable not a function).
Override fast-uri to ^3.1.2 to patch GHSA-q3j6-qgpj-74h6, coming in
transitively through @modelcontextprotocol/sdk → ajv. Harden the http
test mock so it no longer loads real undici via importActual.

Also adds docs/RELEASE.md so the publish workflow is reproducible.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>