feat: ship Buzzr public sports engine and MCP ecosystem

[sarveshsea]

Objective

Ship Buzzr as a complete public sports-settlement and agent toolkit: hardened engine behavior, an 11-tool stdio MCP server, a repository-owned Codex skill, complete package and API documentation, exact release automation, official registry metadata, and measurable adoption baselines.

What ships

• correct, fail-safe DFS settlement behavior with versioned conformance vectors and current PrizePicks push, tie, and DNP semantics
• deterministic fixed-table payout selection, pending results for unsupported zero-loss rows, and validated verification metadata
• @buzzr/mcp with 11 tools, bounded input, schema rejection, correlated concurrency, malformed-input recovery, stdout purity, and clean shutdown
• clean npx -y @buzzr/mcp startup plus real stdio client and cross-platform packed-artifact tests
• repository skill at skills/buzzr-sports-engine with validated examples, discovery, troubleshooting, and isolated install proof
• package README coverage for all ten workspaces plus generated all-package TypeDoc API docs
• official MCP Registry metadata for io.github.Buzzr-app/dfs-engine
• adoption capture for all npm packages, GitHub traffic, issues, referrers, popular paths, and official registry presence

Release train

Five changed public packages are authorized by release-manifest.json:

• @buzzr/dfs-engine@5.1.0
• @buzzr/dfs-engine-test-vectors@5.1.0
• @buzzr/mcp@5.1.0
• @buzzr/dfs-cli@5.0.1
• @buzzr/dfs-testkit@5.0.1

The other five workspaces remain at 5.0.0. Internal dependency pins and all ten versions are release-contract checked.

Verification

• full npm run verify
• 394 engine tests and 95 MCP tests
• engine coverage: 91.8% statements, 86.3% branches
• ten clean-installed packed packages with ESM, CJS, type, bin, provider, testkit, React, and vector replay proof
• real packed MCP initialization and 11-tool discovery
• repository skill validation with the pinned official validator and isolated installer
• 42 documentation files, 107 local references, and 69 external URLs checked
• package-size and export smoke checks
• release workflow and supply-chain regression contracts
• performance benchmark
• tracked-file secret scan
• npm audit: 0 vulnerabilities

Release safety

• build, test, staging, and packing run without OIDC privileges
• exactly five SHA-512-bound tarballs are transferred through SHA-pinned artifact actions
• npm OIDC job publishes only literal reviewed tarballs with lifecycle scripts disabled and provenance enabled
• all five registry versions are preflighted before mutation; conflicts fail closed
• exact partial releases can resume safely after main advances, but new releases still require the reviewed commit to be current main
• npm proof, MCP Registry OIDC, tag creation, and GitHub release are separated and bound to the reviewed commit and hashes
• exact tag creation and release notes are deterministic and rerunnable

Independent review

Final code and security reviews both returned GO on commit 26d31816aabc5d8ab9da62d8a1124ed72a354bce with no residual findings.