Publishing to the MCP registry

server.json carries the version twice and derived neither from package.json, so it advertised 0.2.1 while npm was on 0.2.7 — publishing that would list a version that no longer resolves. It is now folded into sync-version.

The registry also checks that the underlying package claims the same name: for npm that means an mcpName field present in the published tarball, not just the repository. Without it, verification fails.

Publishing runs from CI over GitHub OIDC. Interactively it would mean a device code and a token on a laptop, and a manual step that drifts exactly the way server.json already had.