Fix Glama MCP build and tool introspection

[AjnasNB]

What changed

• add root glama.json maintainer metadata for repository ownership verification
• add a digest-pinned Dockerfile.glama that starts the native stdio MCP process instead of the HTTP daemon
• add npm run check:glama, which performs a real MCP initialize and tools/list exchange and requires all eight public tools
• exercise both the local process and the built Glama container in CI
• document the separate Glama build path in the generated MCP manual and discovery surfaces

Why

Glama was building the repository's root daemon image. That image correctly starts the authenticated HTTP browser daemon, but Glama expects a stdio MCP process for protocol introspection, so the listing reported zero tools and could not produce a Glama release.

Impact

The normal daemon Docker image and runtime behavior are unchanged. Glama maintainers can select Dockerfile.glama with the repository root as build context, deploy it, and inspect the MCP schema without a secret. Daemon-backed tool calls still require the documented URL and token.

Validation

• local npm run check passed
• 65 tests passed, 1 browser smoke test skipped locally by its existing environment guard
• GitHub CI built Dockerfile.glama, initialized MCP inside the container, and discovered all 8 registered tools
• Node 22, 24, and 26; Chromium smoke; packed consumer; hardened daemon container; dependency review; and CodeQL all passed
• package, site, audit, and tarball gates passed with 0 runtime vulnerabilities

[AjnasNB]

Branch-name migration only: replacement #42 points to exact head abadf562746f9ae52e9adbce0d679486abb9510b on neutral ref fix/glama-mcp-release-20260809. The source tree, commits, base, title/body, review request, and protection requirements are unchanged. Closing this duplicate before deleting only the legacy head ref; no source or main history is rewritten.