feat(mcp): add container build

[denial123789]

Summary

• add a minimal multi-stage container for the existing six-tool stdio MCP bridge
• run the container as the unprivileged Node user
• include OCI source, license, and MCP namespace labels
• document local build/run with an external Harness API
• build the image in the existing CI release gate

Validation

• npm run build:runtime
• npx vitest run tests/unit/mcp-server.test.ts tests/integration/mcp.test.ts (13 passed)
• git diff --check
• workflow YAML parse

A local Docker build reached Docker Hub image resolution, but the local daemon received repeated EOF responses from Docker Hub. The PR CI performs the authoritative image build on GitHub infrastructure.

Scope

This PR does not publish an image or register external metadata. It only adds a reproducible source build and CI validation.