Stability checkpoint — MCP server foundation (14 tools, ADR-0062) + grype CVE suppression for transitive mcp-core
