fix(packaging)!: rename PyPI distribution to blc-ssh-mcp and correct install docs

[blackaxgit]

Why the 0.6.0 PyPI publish could never have worked

The name ssh-mcp on PyPI belongs to an unrelated project — author czyhandsome, MIT-licensed, "SSH MCP - tools for remote SSH operations for debugging", last release 0.1.4 in June 2025. This repository has never owned it. PyPI names are globally unique and first-come, so no trusted-publisher configuration could have fixed the invalid-publisher failure — an upload under that name is rejected outright. That is also why "Your projects" on PyPI showed nothing.

The actual defect this exposes

README.md instructed users to run:

uvx ssh-mcp
pip install ssh-mcp
claude mcp add ssh-mcp -- uvx ssh-mcp

All three install that stranger's package. Because it is also an SSH tool, the substitution is not obvious. This PR fixes every install instruction — including the two Claude Desktop JSON examples whose "args": ["ssh-mcp"] form a plain uvx ssh-mcp grep does not catch.

What changes, and what deliberately does not

	Before	After
PyPI distribution	ssh-mcp (not ours)	blc-ssh-mcp
Import package	ssh_mcp	ssh_mcp (unchanged)
Container image	ghcr.io/blackaxgit/ssh-mcp	unchanged
Config paths / env prefix	~/.config/ssh-mcp/, SSH_MCP_	unchanged
Console script	ssh-mcp	blc-ssh-mcp + ssh-mcp alias

The ssh-mcp console script is retained deliberately: the Dockerfile HEALTHCHECK and release.yml's artifact smoke test both invoke it, and existing installs have it on PATH.

A build failure the rename introduced, caught before CI

[tool.hatch.build.targets.wheel] packages = ["src/ssh_mcp"] is now required. Hatchling derives the package directory from the distribution name, so after the rename it looked for src/blc_ssh_mcp, found nothing, and the wheel build failed outright — while the sdist still built fine, so a partial build looks deceptively healthy:

ValueError: Unable to determine which files to ship inside the wheel
Successfully built blc_ssh_mcp-0.6.1.tar.gz     <- sdist OK
(no wheel)

Verification

Built and installed the wheel in a clean venv — not just a metadata read:

Name: blc-ssh-mcp
Version: 0.6.1
Requires-Dist: mcp[cli]<2.0.0,>=1.28.1        <- security floor intact
entry points: blc-ssh-mcp = ssh_mcp.server:main | ssh-mcp = ssh_mcp.server:main
package inside wheel: ['ssh_mcp']
both console scripts execute; import ssh_mcp.__version__ == 0.6.1

• pytest — 717 passed
• ruff format --check / ruff check src/ tests/ / mypy src/ / bandit -r src/ -q / pip-audit — clean
• gitleaks scoped to origin/main..HEAD — no leaks
• uv.lock diff is the project entry rename only (51/51); no dependency resolution changed

Merge order — please read

The 0.6.1 CHANGELOG entry credits the github-release decoupling fix, which lives in #50. Merge #50 first, then this PR, so 0.6.1 is cut from a main that actually contains it. This branch was cut before #50 and does not include it.

Still requires operator action

Create a pending publisher (account-level, since the project will not exist until first upload) at https://pypi.org/manage/account/publishing/:

Field	Value
PyPI Project Name	blc-ssh-mcp
Owner	blackaxgit
Repository name	ssh-mcp
Workflow name	release.yml
Environment name	pypi

A pending publisher does not reserve the name — configure it and tag promptly. Also worth adding required reviewers to the pypi environment: it was auto-created by the 0.6.0 run with no protection rules, so the reviewer gate described in AGENTS.md does not currently exist.