fix: pin installs, restrict releases, and follow MCP host contract

[calvin-archastro]

Review on ArchCode

Problem and author intent

The standalone MCP runs locally with access to user checkouts, OAuth credentials, and short-lived Git material. Installing @latest would silently execute new package bytes whenever a harness restarts, and publishing needs to remain tied to reviewed main code.

This change pins harness installation to 0.1.0, documents explicit upgrades, and puts npm publication behind the protected npm-release environment with a main-branch guard.

It also brings the stdio server up to the official MCP v2 host contract so Codex and Claude can see titles, instructions, field descriptions, and workflow prompts, and it validates device-approval URLs before opening a browser.

What changed

• Pin Codex and Claude npx registration to @archastro/intern-mcp@0.1.0.
• Document explicit remove-and-reinstall upgrades.
• Require the protected npm-release environment and refs/heads/main for publication.
• Fetch full history in CI so PR whitespace checks can resolve the exact base SHA.
• Keep release actions pinned to immutable SHAs.
• Advertise tool titles, initialize instructions, input-field descriptions, resource descriptions, and intern_sign_in / intern_work_on_site prompts.
• Read the MCP server version from package.json.
• Reject non-HTTPS device-approval URLs (loopback HTTP allowed), split-origin pairs, and embedded credentials. Windows opens the URL with explorer.exe instead of cmd /c start.

Scope indicator

Repository packaging, release safety, and local MCP host-facing contract. No backend API changes.

Risk assessment

Low. The change narrows execution and release authority. A future release must deliberately update the documented version. Host-contract additions are discoverability-only except for stricter verification-URL validation.

User impact

Harness restarts keep executing the reviewed package version until the user explicitly upgrades. Claude can invoke /mcp__intern__intern_sign_in and /mcp__intern__intern_work_on_site; all hosts receive workflow instructions at initialize.

Testing

• npm run check — formatting, ESLint, TypeScript build, 20 tests, and clean npm package/stdin-stdout MCP proof.
• npm run test:harnesses — real Codex registration and real Claude connection from isolated user profiles (from earlier commits on this branch).
• Hosted Build, test, lint, and format check should re-run on this push.

Canonical package proof: scripts/package-smoke.mjs installs the tarball into a clean consumer and lists 11 tools over real MCP stdio. Canonical harness proof: scripts/harness-install-smoke.mjs crosses the real Codex and Claude configuration writers; Claude reports Connected.

Follow-ups and known issues

• The npm package is intentionally unpublished while the repository remains private.
• Its first release requires the documented bootstrap token in the protected environment; subsequent releases use npm trusted publishing.
• Firstlanding PR ArchAstro/firstlanding#10040 owns the pinned cross-repository backend compatibility proof.
• MCP Authorization (OAuth between host and this process) is not used: stdio servers should take credentials from the environment; intern_login remains a downstream device-flow tool for hosts that cannot do URL elicitation.