feat: prepare webmcpify v0.5.0 coverage and client contracts - #9

Outcome

Prepares webmcpify v0.5.0 around the lessons from the PlanRadar runs.

• adds an explicit curated | parity target and route-level coverage evidence
• invalidates inventory when the policy that produced it changes
• separates identity, tenancy/billing, credential and delete gates
• blocks insecure verification origins and records backend/CORS assumptions
• guards bare imperative null/undefined results and documents deferred route actions
• classifies failures before retry counting and resets attempts after contract revisions
• adds dated ChatGPT Site tools guidance plus prepared release and directory copy
• aligns all six public distribution descriptions and versions

Proof

• npm run check: typecheck, syntax check and 19/19 tests pass
• npm run proof:verify: Chrome 150.0.7871.186 passes native getTools() / executeTool(), schema, annotations, UI delta, invalid input and cleanup
• git diff --check: clean

Source and compatibility boundary

• WebMCP draft checked at https://webmachinelearning.github.io/webmcp/
• current Chrome implementation guidance checked at https://developer.chrome.com/docs/ai/webmcp
• ChatGPT Site tools guidance checked 2026-08-27 at https://learn.chatgpt.com/docs/webmcp
• Chrome's documented and measured JSON-string execution call remains the verification contract even though the 2026-08-26 draft IDL has moved to an object input
• no public source or measured client run establishes a universal safe tool count; client-capacity gaps stay explicit
• the referenced dev-radar run artifacts were not available in the linked services, local filesystem or GitHub search, so this PR cannot cross-link those original records

Publication boundary

The release notes and directory refresh text are drafts only. This PR does not create a release, submit a directory update, deploy anything or change advertising.