GitLab MCP Server 3.1.0 ڈاؤن لوڈ

## Changelog
### ✨ Features
• b744f34409a6db43f238eeecd527f3fc039aad3b：feat!: read every setting under its prefixed name and no other (#807) (@jmrplens)
• 6bac5426ae7eb97609876edaace5b3e03bc6ac6d：feat(1:1): publish the three clean sent-field blocks, and give memberroles a context (#685) (@jmrplens)
• 9798d14a76f1c7c9dcdcdca316f4229b33f11a36：feat(1to1): R-PAGE, the dimension that asks whether a list says where it ends (#719) (@jmrplens)
• eb67d88e17d6df54499c383ed6855eecee09c5c8：feat(audit): the e2e coverage command, credited from what the server dispatched (#728) (@jmrplens)
• 3d777c978ef754685ad14bac989ceb03b3efa144：feat(audit): two gates for the card shape, reporting what the migration owes (#712) (@jmrplens)
• 6379aba532a6ba5327b51aba196c2f0a5f33e0d9：feat(e2e): call the real server by canonical action ID on every surface (#724) (@jmrplens)
• 71d781288dd803c73ceedba127d60ce856e6b9c2：feat(e2e): declare the call record the rebuilt suite writes and the audit reads (#722) (@jmrplens)
• 6bbaaabcbbe0e75e1e80c2c8f7193a6fe16b7eb9：feat(e2e): measure the server binary in the transport modules (#771) (@jmrplens)
• 64343caef5c7b56f212a01dbc865fe762810aab6：feat(e2e): record what the old suite drives, and the two baselines it produces (#732) (@jmrplens)
• 76c611d4a3aad4a70a7be98391309d50358514bb：feat(e2e): record what the server dispatched, not what the test asked for (#725) (@jmrplens)
• 9c8d44da6c13e68ff18d26740e74505c260b4e42：feat(e2e): start the real server from a harness that probes before it writes (#723) (@jmrplens)
• 35e00d25523f5885c246468da826e81b4da295e9：feat(e2e): the fixture library, with the shared World and the run-scoped sweep (#729) (@jmrplens)
• 015a351e9dee5b71bda02f6b4701c00f4eb03bcb：feat(e2e): the runtime packages, their first tests on the real binary, and a non-blocking CI job (#733) (@jmrplens)
• fbe86dcb4ad25d52681b0d8e0ca1a311b4ae31c3：feat(eval): stop publishing, tell the truth about the numbers, and measure the prompt leak (#772) (@jmrplens)
• f3bad2fc2b48627c3f4677627e5e502abef41f19：feat(http): publish an ETag on the three unauthenticated documents (#694) (@jmrplens)
• 41b95a8b83cbfc4beb8f3f8b21bbf426228e4e5e：feat(http): serve the SEP-2127 card at /server-card, the catalog at the legacy path (#692) (@jmrplens)
• 0a488d504b83c9017eef6c79613e1f91bcc32e40：feat(modeleval): build the Free worlds a case runs in, one recipe at a time (#800) (@jmrplens)
• 9290d77b99d111ccc0b6384d33647f2506c7c8f3：feat(modeleval): call a model, and hash exactly what was sent (#799) (@jmrplens)
• 55fe5c9ea4b6aaf3698ca65b79e623adf1e4f738：feat(modeleval): decide what an attempt was worth, from the record alone (#798) (@jmrplens)
• f484278b99e7951aa7b8cb3406faed3b0a8f63a8：feat(modeleval): declare what one run writes down, before anything writes it (#785) (@jmrplens)
• f55be1233b6ebd44b2287d357abc21c560b613fc：feat(modeleval): finish the corpus, and write down what the move left behind (#794) (@jmrplens)
• c892584c95407df7acbab5178e2a883e7fc05f63：feat(modeleval): hold a case's answer where nothing that asks it can read (#792) (@jmrplens)
• 6d01453b0552342ce2a7b2d6e079916e2f6adf38：feat(modeleval): publish a measurement only when it can say what it measured (#804) (@jmrplens)
• 737e701cae7cf24b82e96b1300b06ea52b315c63：feat(modeleval): put the corpus to a model and write down what happened (#803) (@jmrplens)
• aba93c30d49e6c9a5c73cda202a93bc81deef818：feat(modeleval): raise the world every case runs in, licensed half included (#801) (@jmrplens)
• 34893e181bc6e8e0bd8e62ab942fbed0ed33d360：feat(modeleval): send a model's own call and say what the server ran (#797) (@jmrplens)
• 7ce34e7be86e20a234b6c0edaeae9c2e464578e2：feat(modeleval): show a model the slice of the catalog it can be given (#806) (@jmrplens)
• 874fd3f15d7caad7c2da5d112a703cd071f01c98：feat(release): attest the container image on both registries, and declare Docker Hub (#684) (@jmrplens)
• a036dcdc24ac88f7d4648b071d08756f8d96e336：feat(tenancy): bound tools/list across the process (RTC-007) (#1046) (@jmrplens)
• 726f26cc9d06c8ee857a12160b93bde51b35ddd2：feat(toolutil): add the one card writer and the value vocabulary it needs (#709) (@jmrplens)
### 🐛 Bug Fixes
• 0249c8ddcb6ce786ebbabab1d5b18f5a1caff017：fix(1to1): stop advertising thirteen fields that can never be filled (#696) (@jmrplens)
• 8a006becdf542dee40a001595169318e247c2f36：fix(1to1): stop publishing ten fields no Grape entity exposes (#695) (@jmrplens)
• 7066112fd8212e62014122b8f21477a9de0c9dd5：fix(audit): make one rule decide what a GraphQL document is (#769) (@jmrplens)
• 6407369f70e23ae18dde80e163e5b98deca2a203：fix(bench): draw the benchmark charts so a reader can read them (#795) (@jmrplens)
• 93d7500aec6658207c8b423e1ceb4c465504701d：fix(bench): survive a port lost between reserving it and the child binding it (#793) (@jmrplens)
• 3744f9f3e1f075109522203dfddeab6058cb90a7：fix(build): stop a failed recording reading as a fresh inventory (#770) (@jmrplens)
• 3267f05e5bae8848071cc8fa54eb063a6704e79f：fix(docs): check the anchor half of every documentation link (#788) (@jmrplens)
• 0bf10e910d189ff2f4d46fa77dc1236048ca5934：fix(gitlab): keep a pinned tier through the lazy re-initialization (#1052) (@jmrplens)
• f8a3bbd6d0f99091536866eb0ec0eb9e92de6cd8：fix(http): a blocked address still serves a credential already admitted (#789) (@jmrplens)
• 85a30d29c728441c5f0a8e7837af4d80f95eff10：fix(identity): check the canonical document is a Person before using it (#764) (@jmrplens)
• a8e73ce16685df2a0daacd711439b339e486b594：fix(markdown): link only an http address, and carry a backslashed pipe as text (#721) (@jmrplens)
• a9f41940c85403c9abebc6dd535071f9f1155544：fix(mergerequests): read the merge request back when a cancelled auto-merge answers without one (#752) (@jmrplens)
• 8adba88147571bcaa523b20bec528dc7f8e55e99：fix(meta): stop an alias from rewriting an action the tool routes (#700) (@jmrplens)
• 26d6aebee02e57dad0c9e87274f891245192f41a：fix(model-results): merge a re-run case by case, and let a report be rehearsed (#809) (@jmrplens)
• 6b4cf9c8cc6f4643d97d18b01c7fbfaf3ae6e402：fix(model-results): refuse the two merges that would publish one label over two measurements (#812) (@jmrplens)
• 549c49f3181e59cc6ac53a13063c7fb49f36639c：fix(notifications): refuse a level the update scope does not accept (#852) (@jmrplens)
• 5f0d1dc6289cba7bf0d6825a8a7bd09f3064c7c1：fix(oauth): advertise one scope, so a client asks GitLab for one (#705) (@jmrplens)
• 4d73bc0213b3daea8477a1bf43fc7bfa0d755338：fix(release): sign and attest the image outside the job that builds it (#689) (@jmrplens)
• a7d7c5bfa0451ffc497369c226f4b9040bf7559f：fix(releaselinks): stop promising a field GitLab does not send (#853) (@jmrplens)
• 663fad3c480e86ee5613443e031cb110bf5e1901：fix(repository): echo the archive subdirectory back to the caller (#855) (@jmrplens)
• 534d12d3acc247f5fa295e6e319c5f4c6c84fa09：fix(server): drop a failed shape before its refusal reaches the caller (#768) (@jmrplens)
• 441bd3b47b4ca5bcc120d079d5609822ff51584e：fix(settings): publish GitLab's answer and refuse an unsendable patch (#854) (@jmrplens)
• e4aa7c1e660891b6cf41b21406f65fa6412bc37e：fix(telemetry): name the action a dispatcher ran, and count individual safe-mode previews (#706) (@jmrplens)
• 28b02032dfbb7a63297bd066232af397fd20f17f：fix(telemetry): name the action on the first call a process serves (#816) (@jmrplens)
• 2f745728aaa990b7fadf6f58140d76ece87d0d8e：fix(telemetry): name the action registration bound to an individual tool (#701) (@jmrplens)
• 9ae164bac7e54bc7abdc2ca992a36a9dc99dcf45：fix(test): give the polling-transition test a budget two polls fit in (#686) (@jmrplens)
• ca490172982af4fb85b837ec15d310a60eaea004：fix(test-tooling): give a mutant a timeout it can survive being started in (#813) (@jmrplens)
• 7ebcc616ca8029ae4c54e9009a1f70d0717af1b0：fix(tools): stop rendering credentials in tool Markdown (#708) (@jmrplens)
• 856a0a6c506db5260eadfeb2eb5564eee1307bfd：fix: three published claims the code stopped making, and a decoder that accepted an ambiguous identity (#805) (@jmrplens)
### ⚡ Performance
• 4098b135b089927113322f0805fb9ea2b7277900：perf(tests): cut a quarter off the unit suite and close every coverage gap (#811) (@jmrplens)
### 📚 Documentation
• df52b3a8059505f4024662bed0f35ad2c9727a9b：docs(1to1): declare the 49 project-group fields as a wrong route annotation (#688) (@jmrplens)
• 706f74b8dcace10422d54d533156d63de63d0168：docs(adr-0018): correct what publishes the catalog, and pin the citation (#691) (@jmrplens)
• 7848eb490968118ed29613358ba9ae8e95e6a9f8：docs(eval): withdraw the published model numbers (#783) (@jmrplens)
• 7db1440aa4704da249b80cce5455f8179dae2df7：docs(oauth): check read_api beside api on a writable deployment's application (#702) (@jmrplens)
• c95f43673aaaf99ad6ad80595b60c345e50fd53a：docs(upstream): go-sdk 1273 is merged, and not yet in a release (#814) (@jmrplens)
• 890a089316270fa387c213feb0f8b4823133a473：docs(upstream): record the go-sdk batch and the auto-merge cancel annotation (#753) (@jmrplens)
• 8588a080cc2fe4b32f1c88a5db3eda4bf1e7033c：docs(upstream): record the go-sdk findings and correct the auto-merge entry (#784) (@jmrplens)
• 46be989a32f9f0d2b2e4f3b0f251a1b49ff604a0：docs(upstream): record the merge requests that landed and the versions carrying them (#681) (@jmrplens)
• c613692bc94322887859c860dde2d9569688f9ce：docs(upstream): record the two client-go merges and the page merge, and give six entries their summary rows (#739) (@jmrplens)
• 09952937cf0dc2482c0878adc2b347717c4bb5ea：docs(upstream): record three GitLab endpoints that declare a response they do not send (#682) (@jmrplens)
• 4da8537461ea7497aab28bdf2e886bdd5fb03694：docs: retire the deleted e2e suite from the documents that still ran it, and sweep the dependencies (#767) (@jmrplens)
### 🚧 Maintenance
• e7ae118d1ca7bc5f8c9737829fef092502b039a6：Answer the rework verdicts the mutation round left open (#818) (@jmrpl