ci: verify MCP Registry after publishing

[Davidson3556]

What does this change?

The registry publishing workflow now verifies the public MCP Registry entry after mcp-publisher publish completes. The checker compares package.json, server.json, the exact and latest registry entries, and the metadata returned by npm view.

It fails when:

• the server or package version differs
• the package identifier or registry type differs
• the npm tarball's mcpName differs from the registry server name
• the expected npm version no longer resolves, is deprecated, or is no longer latest
• the registry entry is inactive or a different version is marked latest

The check retries temporary HTTP failures and successful-but-stale registry responses so normal post-publish propagation does not create a false failure.

The same checker also runs daily and can be triggered manually, covering the scheduled drift check suggested in the issue.

Related issue

Fixes #16

Checklist

• npm run build passes
• Server starts and existing tools remain unchanged
• Works in mock mode (no credentials configured)
• No secrets, real hostnames, account IDs, or personal data added
• No patient images added — including in tests
• No medical behavior changed

Does this change a tool's response shape?

No. This only changes release and scheduled verification.

Validation

• npm test — 91/91 tests pass
• node scripts/verify-registry-listing.mjs — passes against the live registry and npm package

[YauhenBichel]

Nice idea, catching a stale listing early is really useful. Thank you! Two small changes please:

1. Pin the actions by SHA in the new workflow: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 and actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0.
2. In publish-mcp-registry.yml, please move the verify step into its own job (needs: publish, permissions: contents: read). Then the script does not run with the id-token: write permission.