Build MCPLock: catch breaking MCP tool changes

[wenn-id]

What changed

• Added a zero-runtime-dependency Python CLI for snapshotting one stdio MCP server's tools/list contract.
• Added deterministic, atomic mcp.lock.json generation and strict lockfile validation.
• Added compatibility checks for removed tools/properties, newly required inputs, narrowed JSON types, enum removals, and additionalProperties restrictions.
• Added bounded diagnostics, request-wide timeouts, protocol-version negotiation, pagination, and child-process cleanup.
• Added offline unittest coverage, packaging, documentation, MIT licensing, contribution guidance, and cross-platform GitHub Actions.

Why

MCP tool schemas are runtime contracts presented directly to agents. MCPLock makes breaking drift visible in Git and CI before an agent encounters it in production.

Developer impact

Run mcplock update -- COMMAND ... to create the lockfile, commit it, then run mcplock check -- COMMAND ... in CI. Compatible and warning-only changes exit 0; confirmed breaking changes exit 1; usage, lockfile, launch, timeout, and protocol failures exit 2.

Validation

• 38/38 offline tests passing
• Deterministic update/compatible/breaking CLI smoke tests
• Isolated wheel build and metadata verification
• Fresh wheel installation and console-entry-point smoke test
• Python 3.11/3.14 CI matrix across Linux, macOS, and Windows
• Whole-branch independent review: ready to merge