v0.7.2

MCP Runtime v0.7.2 restores usage analytics for MCP servers whose gateway sidecars were rejected by mcp-ingest, and teaches mcp-runtime update to deliver this kind of change.

• Gateway sidecars authenticate to mcp-ingest with a projected ServiceAccount token (audience mcp-ingest, validated by TokenReview, accepted only from the mcp-workload ServiceAccount) instead of a copied ingest API key. Servers whose key was missing or stale were answered with 401, which left the usage analytics dashboard empty.
• mcp-runtime update now applies the ServiceAccounts, RBAC and Deployment wiring a release declares in platform-manifest.json, in addition to images and CRDs. Declared RBAC is validated (no wildcard or escalate/bind/impersonate rules, platform namespaces only, bindings only to roles in the same bundle). Only differing objects are written, previous wiring is restored if a rollout fails, and --only skips objects and blocks workloads that need a missing ServiceAccount.
• cluster doctor adds ingest service account auth and gateway analytics delivery checks and updates gateway analytics credentials for projected tokens.
• Gateways count undelivered events in mcp_gateway_analytics_emit_failures_total, and k8s/11-prometheus.yaml adds the MCPGatewayAnalyticsEmitFailures alert.
• Go dependencies are updated across the root and service modules.

Upgrade: use the v0.7.2 CLI (older CLIs reject the new manifest fields) and mcp-runtime update --to v0.7.2; no full setup is needed. Running gateways pick up the token volume when the operator reconciles. The new Prometheus alert is a ConfigMap change that update does not apply, so it reaches an existing cluster on the next setup. There are no CRD changes.

Fixes #719 (implemented in #720) and #724 (implemented in #726).

See the changelog and reference deployment guide.

Validation: CI and all 15 Pre-release Regression jobs, including strict-production staging, passed on the tagged revision.