docs: direct HTTPS /mcp/<uuid> hosted setup; retire relay OAuth guidance

[dzianisv]

Aligns public MCP docs with the supported direct HTTP connector and adds a hermetic guard so the contract cannot regress.

What changed

• README — hosted setup is https://relay.api.vibebrowser.app/mcp/<uuid> only. Explicit "no OAuth consent, no DCR, no scopes". Marked hosted-client table (HTTPS only, no wss). Claude Desktop row labelled alternative only — prefer local stdio when Chrome is on the same machine. Exact codex mcp add vibe --url … documented. New migration section away from the retired consent-screen connector.
• server.json — onboarding path = Vibe icon → Settings → AI Agent Control → Remote (internet) → Relay access; states no OAuth/DCR/scopes; carries the migration note.
• worklog/ — Aug 2026 directory-submission research kept verbatim, each file banner-marked HISTORICAL; the OAuth-first §8.2 section marked SUPERSEDED.
• scripts/e2e-docs-contract.mjs (new) — hermetic, no network. Wired into test and test:ci.
• status.md — supported/unsupported transport table.

Contract guard (33 assertions)

Pins: direct HTTPS /mcp/<uuid> in README + server.json remote; no OAuth setup lines in any active surface (README, status.md, server.json, openclaw/vibebrowser/SKILL.md, mcpb/manifest.json, docs/*.md), with worklog/ explicitly excluded and separately asserted historical; no wss:// in the hosted table; verbatim codex mcp add vibe --url; migration note; no markdown link from an active surface into worklog/.

Negative controls (injected, then reverted) both fail the guard as intended:

• Complete the OAuth consent flow to authorize Vibe. → CAUGHT
• Register the client at …/oauth/authorize and pick scopes. → CAUGHT

Verification

• npm run build — PASS
• npm run validate:skill — PASS
• npm run test:ci — exit 0, all 12 suites
• docs-contract ok (33 assertions, hermetic — no network)

No version bump (docs + test only). No backend or deploy changes.

Supersedes #141 (already closed).

Fixes #134

Refs #130

[dzianisv]

Owner review

Final fresh review: SHIP.

• README/server.json/current docs pin direct HTTPS /mcp/<uuid> and exact Codex command.
• Local stdio and WSS CLI/skill paths remain supported.
• Historical OAuth research is clearly marked and not linked as current guidance.
• Hermetic docs guard caught 8/8 injected regressions; CI is green.