release: prepare GhostMCP v0.2.1 and Trusted Publishing

[jason-allen-oneal]

Summary

• prepare GhostMCP 0.2.1, including the existing TLS 1.2 floor and audited dependency updates
• replace the unused long-lived PyPI token path with a tag-only, explicitly gated OIDC Trusted Publisher job
• require tag/package-version equality and protected-main ancestry before building a release
• pin upload, download, and PyPI publishing actions to immutable commits
• keep GitHub release artifacts, SBOM, and build attestations intact
• add release identity and no-token regression coverage that runs under the repository's unittest CI

Repository controls

• private vulnerability reporting is enabled
• the pypi environment allows only v* tags, requires morrow-bluedot approval, and prevents self-review
• an active tag ruleset restricts creation/update/deletion of v*.*.* to the dedicated release authority
• PYPI_PUBLISH_ENABLED remains absent until the pending publisher is verified on PyPI
• the two secrets used only by the retired repository-local Codex scanner were removed

Verification

• exact unittest discovery: 90 passed, 1 skipped (including both release metadata tests)
• focused release/TLS suite: 8 passed
• Ruff: passed
• release workflow YAML parse: passed
• wheel and sdist built as 0.2.1; Twine: passed
• git diff --check: passed

Release

This PR does not create v0.2.1. Tagging remains deferred until the exact merged head is green and the ghostmcp-server Trusted Publisher is configured on PyPI.

[morrow-bluedot]

Independent exact-head review passed after release-authority findings were corrected. Head e10c3d6 binds tag to package version and protected-main ancestry; the live tag ruleset restricts v*.. creation/update/deletion to the release authority; the pypi environment requires separate approval and prevents self-review. Release tests now execute under unittest CI. All exact-head checks are green.