Make cma production-ready, relocate to a personal account, upgrade MCP

[lluvr]

Summary

Makes cma production-ready, relocates it to a personal account (lluvr/cma), and upgrades the MCP server to the current protocol.

Root and structure

• Trim the repository root to 10 files: the deep-dive docs (DESIGN, ARCHITECTURE, DATA, DECISIONS, GOVERNANCE) move under docs/, and test.sh / bench.sh move under scripts/. Every internal reference, workflow path, generated-README URL, and doc link is updated. Committed build artifacts removed.

Self-contained and personal

• Neutralize references to the private Lodestone repository that resolved to 404 for adopters, keeping the public sibling links (Touchstone, frame-check) and the blog.
• Move self-references to lluvr/cma and drop the organization publisher and author framing. The citation shipped in every MCP payload now reads (L. Lucic, 2026).
• Remove the Zenodo DOI references from both CITATION.cff files and soften the publisher-identity claim in SECURITY.md, pending re-issuance under the new account.

MCP upgrade

• initialize negotiates the protocol version (echo a supported revision, otherwise the newest: 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05) instead of hard-coding 2024-11-05; per-call provenance reports the revision negotiated for the session.
• Every tool declares a three-section outputSchema, and tool calls return structuredContent (validated against it) alongside the text block, so clients on 2025-06-18 or newer consume structured output while older clients keep the text form. Server instructions rewritten to stand alone.

Hardening

• gitleaks exempts the canon detector and its self-test fixtures (they carried the forbidden patterns by construction); .gitignore covers .ruff_cache and .claude/settings.local.json; PEP 740 attestations pinned in the publish workflow; stale versions and counts and a false wheel-bundling claim corrected; punctuation normalized to plain ASCII across committed content.

Test plan

Ran the CI-equivalent locally, all green:

• scripts/test.sh: 143 pass
• pytest: 57 pass
• shellcheck 0.10.0 on all six shell files: clean
• canon_audit.sh --self-test and scan: clean
• wheel build plus a clean-venv install smoke: the installed cma-mcp --version and --test console script works (protocol_version: 2025-11-25, citation (L. Lucic, 2026))
• jsonschema validation of structuredContent against the advertised outputSchema

Related-project impact

Touchstone and frame-check public links kept; Lodestone references neutralized (private repo). No cross-repo coordination required.