feat(api): expose API and MCP compatibility metadata

[JSONbored]

Parent roadmap: #82

Background

MCP users need to know when their local package is stale or incompatible with the live API. This already matters because local installs can lag behind npm and API changes.

Goal

Expose a small compatibility contract that MCP doctor and status can consume to report API version, supported MCP versions, latest package version, and breaking-change notices.

Current Behavior

MCP can check some local/package state, but compatibility with the live API is not a first-class contract.

Desired Behavior

gittensory-mcp doctor/status can explain whether the installed CLI is current, stale but usable, or incompatible with the API.

Implementation Requirements

• Add a private or public-safe compatibility endpoint.
• Include API version, minimum supported MCP version, latest recommended MCP version, and compatibility warnings.
• Update MCP status/doctor to consume the endpoint.
• Keep response stable and machine-readable.
• Avoid exposing internal deployment identifiers or secrets.

Public/Private Output Boundaries

Compatibility output can mention package versions and API compatibility only. It must not expose session tokens, admin flags, private repo data, or scoreability details.

Acceptance Criteria

• MCP status reports compatible current install.
• MCP status reports stale install with upgrade guidance.
• MCP status reports incompatible install with hard failure guidance.
• API failures degrade gracefully.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally to avoid CI variance.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, queue pressure, source-upload safety, public/private boundaries, or upstream drift.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.
• MCP/local tooling must prove source contents are not uploaded.

Additional Test Scenarios

• Endpoint schema test.
• MCP registry/API success and failure mocks.
• Stale package fixture.
• No token/local path leakage regression.