v4.4.1

Public release mirror + dependency audit fixes. Customers now get the server from the public
repo zuarbase/Zuar-Portal-MCP-Public, a release-snapshot mirror of this one: each stable tag is
published there as a single squashed commit (+ tag + GitHub Release with the .mcpb), never the
development history. scripts/publish-public.sh builds the snapshot from git archive of the tag,
strips everything in .publicignore, runs a leak gate (private slugs, hostnames, token shapes) and
refuses to push on any hit; .github/workflows/publish-public.yml runs it when a Release is
published here.

Changed

• package.json homepage / repository / bugs and the README / docs install links now point at
  the public repo — that is the URL customers can actually reach.
• npm audit: fast-uri, brace-expansion, @hono/node-server, @modelcontextprotocol/sdk bumped
  (shipped on main after 4.4.0 without a version bump; this release carries them).

Added

• .publicignore, scripts/publish-public.sh, .github/workflows/publish-public.yml — the mirror.