feat: publish Buzzr on Smithery

[sarveshsea]

Summary

• build a deterministic, provenance-bound MCPB from exact @buzzr/mcp@5.1.0 registry bytes
• publish the full runtime-discovered 11-tool server card to sarveshsea/buzzr-sports-engine
• download, hash-check, and real-client re-prove the accepted Smithery artifact
• document Smithery as local stdio distribution and protect the contract in CI
• harden archive handling, credential isolation, and Linux/macOS/Windows coverage

Testing

• npm run verify
• npm run check:links:external
• npm audit --omit=dev --audit-level=high --prefix smithery
• cross-time-zone deterministic build regression
• independent final code and security reviews: no blockers

Release proof

• Smithery page is live
• deterministic MCPB SHA-256: b734c2c78d56ffda4529ec390e4cdb26eca71d1647ab19652fca944157da70f9
• exact npm integrity: sha512-5xWiYpL0CY4qtHWd9r23SnII4eBxFmr1D6jKilEV8BItleTsT3b8vBLr3F4id0YejlRGxPjeW/68Z4QCa1FzbA==

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}