chore(mcp): separate SDK release from marketplace plugin

[ducnmm]

Summary

Keep MCP SDK and npm release ownership in the MemWal monorepo while the Claude marketplace package is prepared in CommandOSSLabs/walrus-memory-mcp-plugin.

• document packages/mcp as the canonical SDK/npm source
• stop bundling the duplicate marketplace plugin directory in npm tarballs
• add the missing patch changeset for PR fix(mcp): refresh bridge credentials after login #597's live credential refresh/security behavior

The existing monorepo plugin files are deliberately not deleted in this PR: current public docs still point at the monorepo marketplace. They can be retired after the standalone plugin PR lands, the repository is transferred, and docs are switched atomically.

Validation

• MCP typecheck passed
• MCP tests 10/10 passed
• MCP build passed
• npm pack --dry-run contains 38 runtime files and no plugin/ copy
• git diff --check passed

Related marketplace handoff: CommandOSSLabs/walrus-memory-mcp-plugin#4.

[ducnmm]

@harrymove-ctrl Please review current HEAD 294b0ceb. This keeps SDK/npm publishing canonical in MemWal and stops the npm tarball from shipping a duplicate marketplace plugin. The standalone marketplace handoff is CommandOSSLabs/walrus-memory-mcp-plugin#4.

[ducnmm]

Reviewed exact head 294b0cebb9ed6d67c5bf77eb6ae36e3987f07eec. The ownership split is clean and appropriately scoped: packages/mcp remains canonical, removing plugin from files stops future npm tarballs from bundling the marketplace copy without deleting the still-referenced monorepo source, and the patch changeset correctly accounts for #597. git diff --check is clean and all 10 CI checks pass.

No code blocker in this PR. I cannot formally approve because this PR is authored by the current GitHub account. Rollout note: #604 must be merged and a patched npm release must actually be published before the standalone marketplace plugin can truthfully claim that current releases support post-login credential hot reload.

[ducnmm]

Follow-up after marketplace plugin head 40298706: PR #4 now safely gates its required CI on npm @mysten-incubation/memwal-mcp@latest >= 0.0.7 and has reverted the premature hot-reload documentation claim while npm remains at 0.0.6.

This PR remains unchanged at 294b0cebb9ed6d67c5bf77eb6ae36e3987f07eec; all checks are green and I found no code blocker. It is now the first dependency in the correct rollout order: approve/merge #604 → publish patched MCP release → verify npm latest → clean-install plugin login smoke → allow plugin PR #4 to turn green and merge.

[ducnmm]

@harrymove-ctrl Final reminder: please approve exact HEAD 294b0cebb9ed6d67c5bf77eb6ae36e3987f07eec if your re-review has no blocker. All required CI is green. This approval is the first gate before publishing MCP 0.0.7+ and unblocking the plugin-only repo rollout.

[ducnmm]

Superseded by merged PR #613, which manually bumped MCP to 0.0.7, added the complete concise changelog, documented canonical SDK ownership, and removed the plugin copy from future npm tarballs. Closing to avoid duplicate/conflicting release preparation.