docs: roadmap built out from landscape research

[TMHSDigital]

Summary

Fully builds out ROADMAP.md, reshaped by the Gemini deep-research landscape report (included in docs/research/ along with the prompt that produced it).

Decisions the research changed:

• Tool annotations promoted to v0.2, first item — the MCP spec treats unannotated tools as destructive/non-idempotent, and Claude Code uses readOnlyHint as a concurrency signal, so our read-only tools are currently serialized and over-confirmed.
• LocalAPI provider narrowed to the two high-stability endpoints (/status, /whois); the LocalAPI is officially unstable, so CliProvider stays the default elsewhere.
• v0.3 anchored on the two uncontested competitive gaps: bridging local daemon + Admin API in one server, and ACL validate/preview dry-run pre-flights (no existing server offers either).
• v0.4 adds identity-gated execution (whois + ACL capability grants — the published confused-deputy mitigation).
• Streamable HTTP, OAuth discovery, elicitation deferred with client-support rationale; dashboards explicitly out of lane.
• v1.0 distribution: signed Docker + SBOM (Docker MCP Catalog), Smithery, standalone binaries.

Notes

• No version bump: repo-docs only; ROADMAP.md and docs/ don't ship in the npm package, and release.yml no-ops idempotently on the existing v0.1.2 tag.

🤖 Generated with Claude Code