feat(DEN-2885): harden canonical Leddy MCP publication seed

[ORESoftware]

What changed

• replaces the seed's handwritten newline-delimited JSON-RPC dispatcher with the official Rust MCP SDK pinned exactly to rmcp =3.1.0;
• embeds the exact ore.api-docs.v1 manifest and OpenAPI bytes from led-dynamo/leddy-api-server.rs PR docs: link GitHub Project and Linear planning #4 at API head aea63f652a20c087260bab3c86b31baa80eaa7ea;
• exposes exactly the five standard read-only tools: api_docs_discover, api_docs_get_openapi, api_docs_validate, api_docs_list_operations, and api_docs_describe_operation;
• annotates every tool read-only, non-destructive, idempotent, and closed-world;
• preserves all six canonical Zed dependency coordinates and .vendor/.zed materialization from the original seed;
• adds typed filters, bounded output, strict input rejection, immutable snapshot provenance, six-operation validation, health-only exposure, and explicit device/WebSocket exclusion;
• adds a real child-process stdio protocol test, unit tests, an MSRV lane, deterministic official-SDK checks, nested repository CI, and a root workflow that compiles the seed before publication;
• hardens publish.sh to require leddy-sync, refuse overwrite, generate and validate Cargo.lock, run the full Rust gate, and create the public repository only from the reviewed seed.

Semantic reconciliation

The earlier seed from .github#19 correctly established package identity, publication order, and the Zed dependency graph, but its single zed_dependency_graph tool and handwritten protocol loop conflict with the later accepted ore.api-docs.v1 contract in ORESoftware/mcp-rust-libs@47e411311523013f90db98390671d683475d6c74 and API PR #4.

This change preserves the compatible intent from both histories: Zed remains authoritative for package identity and dependency intent, while the official MCP SDK owns protocol behavior and the tool catalog is narrowed to the five contract-defined, non-executable documentation tools. No side was selected wholesale, and no repository, branch, or concurrent artifact was removed.

Safety boundary

The server performs no network request, accepts no credential, follows no redirect, opens no WebSocket, reads no live device state, and cannot publish or clear display state. Only GET /health is marked MCP-exposed in the embedded document; all mutations and device/telemetry surfaces remain descriptive only.

Validation

Local static checks completed for TOML, JSON, SHA-256 parity, YAML syntax, and publisher shell syntax. The new root workflow is the authoritative Rust formatting, Clippy, unit, process-protocol, documentation, release-build, SDK-resolution, and MSRV gate.

Remaining publication gate

This PR improves the committed source artifact but does not claim that the two missing repositories exist. Publication remains ordered:

1. DEN-2884 publishes and validates led-dynamo/leddy-sync;
2. DEN-2885 publishes this seed as led-dynamo/leddy-mcp-server.rs;
3. led-dynamo-test proves immutable API/MCP parity;
4. API PR docs: link GitHub Project and Linear planning #4 may then be promoted without changing its tested heads.

Linear: DEN-2885, DEN-2884, DEN-3159. GitHub: .github#18, .github#17, leddy-api-server.rs#4.