ci: auto-publish to MCP Registry on tag push

[jjacks95]

Summary

Adds MCP Registry auto-publish to the existing tag-push workflow so future v* releases land in registry.modelcontextprotocol.io without anyone running mcp-publisher from their laptop.

Today the registry entry has to be refreshed manually each release — this PR closes that gap.

What changes

Four new steps appended to .github/workflows/publish.yml, gated to run only on real PyPI publish (tag push or workflow_dispatch with target=pypi). TestPyPI dispatches are skipped:

1. Sync server.json version with the pushed tag (jq) — prevents drift between the git tag, pyproject.toml, and server.json. Maintainer only has to bump pyproject.toml going forward.
2. Install mcp-publisher from the official modelcontextprotocol/registry release tarball.
3. Authenticate via GitHub OIDC — reuses the existing id-token: write permission already granted for PyPI Trusted Publishing. No new secrets.
4. Publish with retry — 5 attempts × 30s backoff, because mcp-publisher reads the package README from PyPI to verify the mcp-name claim and PyPI's CDN can lag 30–90s after a fresh upload.

Why OIDC over PAT

GitHub OIDC (mcp-publisher login github-oidc) is the recommended path per the official docs. It needs no stored secret because GitHub Actions exchanges an ephemeral OIDC token for a short-lived registry token. Same trust model as the PyPI Trusted Publishing step already in this workflow.

What this does not change

• Build, test, PyPI upload, GitHub Release upload — all unchanged
• Workflow name, triggers, environment, permissions — all unchanged
• TestPyPI dispatch behavior — still skips MCP Registry as expected

Test plan

• python3 -c "import yaml; yaml.safe_load(...)" — syntactically valid
• Diff is purely additive (39 lines appended), no edits to existing steps
• All four new steps gated by if: clauses matching the existing PyPI step
• Real test happens on next tag — recommend cutting v1.3.2 (or whatever next bump is) to validate the full chain. If MCP publish fails for a fresh reason, the 5 × 30s retry surfaces it in workflow logs without silent failure.

Reference

• Official MCP Registry GitHub Actions guide
• Current registry entry (manually published 2026-04-23): io.github.lqwdtech/saturnzap v1.3.0 + v1.3.1 are both live, v1.3.1 marked isLatest: true

[jjacks95]

Rebased on top of main to clear the stale base — mergeStateStatus was `BEHIND` against the 4 new commits since this PR opened (macOS install fixes, cross-platform LDK Node wheel workflow, faucet path docs, TMPDIR rename).

• Rebase was conflict-free — main hadn't touched publish.yml since 10dbb7e (pre-PR-base)
• python3 -c "import yaml; yaml.safe_load(open('.github/workflows/publish.yml'))" passes
• All 39 added lines preserved unchanged; diff against main is still purely additive

Ready for review when you have a moment — gentle bump on this one. Related: PR #19 (description keyword optimization) is a small companion that will benefit from this CI machinery once both merge.