feat(cli): add read-only MCP server - #3

Summary

• add vminfo mcp, a tools-only local stdio MCP server backed by existing vminfo collection and network APIs
• expose seven structured, bounded tools for host snapshots, Linux processes, DNS, TCP, ping, IP lookup, and version metadata
• keep destructive commands, remote transport, prompts, resources, shell access, file writes, and background updates out of MCP mode
• document Claude Desktop and Codex setup, privacy boundaries, and release positioning

Security boundary

• process command lines are hidden unless include_command is explicitly enabled
• local tools are marked closed-world; network diagnostics are marked open-world
• stdio is the only transport and stdout is reserved for protocol messages
• all collection and network operations have bounded inputs and timeouts

Validation

• go test ./...
• go test -race ./...
• go vet ./...
• go mod tidy -diff
• govulncheck ./...
• real subprocess MCP initialize / tools/list / get_version round-trip
• CLI smoke checks
• goreleaser release --snapshot --clean