ci(release): bump mcp-server-release.yml pin to pick up cosign/sigstore verification

[asachs01]

Summary

Bumps the pinned WYRE-AI/.github/.github/workflows/mcp-server-release.yml reusable-workflow commit from 07bc1921 to 8c236005 (current main tip).

07bc1921 (2026-08-24) predates WYRE-AI/.github#2 (merged 2026-08-27, warden's Gate-3-reviewed fix), which added cosign/Sigstore signature verification of the mcp-publisher binary before extraction — until this bump, this repo's release job installs mcp-publisher with zero pin, checksum, or signature check. 8c236005 is 3 commits past the fix; those 3 commits don't touch mcp-server-release.yml (confirmed via diff), so it's safe to bump straight to current tip rather than pin to the fix commit exactly.

Identical mechanical change across all affected *-mcp repos (found via a full org enumeration cross-checked with warden's independent scan — 53 repos, same result). Part of a coordinated class-ask, not merged individually; holding for the batched Aaron authorization (mcp repos are walled).

Test plan

• Confirmed the new sha's file content includes the cosign verify-blob step (diffed directly, not inferred)
• Confirmed the 3 commits between the fix and this bump's target don't touch the reusable workflow file
• N/A — no functional test beyond the workflow reference itself; CI will exercise the new pin on the next real release from this repo

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}