Upgrade graphql to 17, fix runner job-status query, and auto-generate server.json marketing copy

[polaz]

Problem

Three maintenance items, shipped together in a single PR:

1. server.json undersells on the MCP Registry. Its description reads
   "GitLab MCP server with 58 tools for projects, MRs, pipelines, and more",
   while the README markets the server as "58 CQRS tools exposing 230 GitLab
   operations across 26 entity types". The richer line is the marketing copy we
   actually want on the public registry listing.

2. Marketing READMEs drift. prepare-release.sh renders the README to all
   three shipping locations (core npm page, GitHub repo landing, db npm page),
   but the release workflow only staged the core README, so the root and db
   READMEs were stuck a release behind (download badge still pointed at 9.0.0
   while core was at 9.1.0).

3. Dependabot proposes graphql 16 -> 17 (chore(deps): bump graphql from 16.14.2 to 17.0.0 #532 / chore(deps): bump graphql from 16.14.2 to 17.0.0 in /packages/gitlab-mcp #533). The bump needs
   verification that the full suite stays green and that graphql-tag keeps a
   valid peer range.

4. Runner job-status query bug (found while running the full integration
   suite). browse_runners action list_jobs declares $statuses: CiJobStatus
   but GitLab's jobs(statuses:) argument is [CiJobStatus!]. GitLab rejects
   the query with "List dimension mismatch on variable $statuses" whenever a
   runner with jobs exists. Pre-existing, exposed once the test instance had a
   runner with executed jobs.

Solution

• Bump graphql to ^17.0.0 and graphql-tag to ^2.12.7 (its peer range now
  includes graphql 17). Node engine already requires >=24, which graphql 17
  supports.
• Bump safe within-major dependencies: @clack/prompts 1.5.1 -> 1.6.0,
  @cloudflare/workers-types and @types/node patch refresh.
• Fix the runner query to $statuses: [CiJobStatus!] and wrap the single-status
  filter in a list; add a regression assertion in the unit test.
• Make prepare-release.sh generate the server.json description from the live
  tool / operation / entity counts, mirroring the README hero line and staying
  under the MCP Registry 100-char limit.
• Stage all three rendered READMEs in the release-PR sync job so the public
  counts and version never drift between npm, GitHub, and the db page.

Acceptance criteria

• Full unit suite green (5206 tests) and full integration suite green (443
  tests) on graphql 17.
• server.json description reads "58 CQRS tools exposing 230 GitLab
  operations across 26 entity types" and is regenerated at release.
• Root and db READMEs are committed by the release sync job.
• Runner list_jobs works against GitLab for runners that have jobs.

Time estimate

3h (dependency evaluation, two full integration runs, query fix with regression
test, release tooling, verification).

[coderabbitai]

🔗 Related PRs

#355 - chore(deps): update all dependencies [merged]
#396 - refactor: thread instanceUrl and key caches by URL [merged]
#474 - docs(readme): lead with CQRS differentiator [merged]
#477 - feat(runners): expose CI runner management via GraphQL [merged]
#481 - feat(vulnerabilities): expose Vulnerability Management via GraphQL [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!