ci: sync docs from verified MCP releases

[Dirtybird99]

What changed

• restores the reproducible-builds guide that is live on derod.org but missing from main
• replaces the long-lived personal dispatch token with a narrowly installed GitHub App
• accepts only verified dero-mcp-server release manifests and opens a reviewable docs PR
• syncs the tagged SKILL.md, all four MCP discovery documents, the MCP page, and agents.md
• removes the unpublished Server Card schema reference and labels the current document as compatibility metadata

The 0.6.0 surfaces are intentionally not published by this PR. They are generated only after the hosted endpoint passes both legacy and 2026-07-28 probes.

Validation

• runtime-derived sync fixture: 33 tools, 4 resources, 5 prompts, 12 composites
• MCP sync guard and YAML parse
• link health, boundary validation, and API parity
• production builds: derod, TELA, Hologram, DeroPay
• privacy scan: no local paths, personal email addresses, credentials, or secrets

Maintainer setup before merge

Install one GitHub App only on DHEBP/dero-docs and DHEBP/dero-mcp-server with Contents: read/write and Pull requests: read/write. Add MCP_SYNC_APP_ID as an Actions variable and MCP_SYNC_APP_PRIVATE_KEY as an Actions secret in both repos. The automation opens PRs; it never auto-merges them.

[vercel]

@Dirtybird99 is attempting to deploy a commit to the DHEBP's projects Team on Vercel.

A member of the Team first needs to authorize it.