chore(release): prepare MCP 1.0.21

[escott-]

Bumps the workspace, npm package, MCP Registry metadata and the boundary self-test to 1.0.21, and adds the 1.0.21 changelog.

What ships (11 commits since v1.0.20, plus two release fixes on main):

• Hosted gateway: no reads or writes of its own disk for a caller's path (339f5d5, incident 0cc8b87e), no self-update (ddcae54), per-request tool surfaces (5c42d4b), search rooted at the session's checkout (fix(search): hosted results are rooted at the session's checkout, not the first machine's folder #168)
• Hooks: the hidden "ATTRIBUTION" block is gone (4879e0b); opt-in coaching turns (053d961; API route eb4430485 is in the live backend)
• Sync bridge links the checkouts agents work in (fix(watch): sync the checkouts agents work in on a machine set up for hosted MCP #167)
• entity: visibility kept on update, target_project, honest replies, discussion kind removed (901a2fc)
• Search: whole-word skill matching (6bbf26b)
• stdio resume adopts the API's session id (1.0.15: session resume (no args) returns the caller's own session over stdio (regression from 1.0.14) #152) and one-shot commands survive a closed pipe (1.0.18: doctor, about, and setup panic (exit 134 / SIGABRT) with "failed printing to stdout: Broken pipe" when piped to head #159) (fix: stdio resume leaves out the caller's own session; CLI output survives a closed pipe #166)
• Setup review-card gap (074c45f)
• Release fixes already on main: neutral test fixtures, because main failed public_boundary.py (865fa5c); quinn-proto 0.11.19 in Cargo.lock for RUSTSEC-2026-0338 to 0342, an optional reqwest HTTP/3 dependency that no binary contains (87d6488)

Checked on ovh-desktop against main 87d6488 plus this change:

• cargo fmt --all --check; cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace --all-targets: 3223 passed, 0 failed, 21 ignored
• account_connection_smoke: 9 tests
• cargo audit --deny warnings (403 crates, no advisories) and cargo deny --locked check (duplicate warnings only)
• On a clean archive: release_contract metadata and resolve-version for tag v1.0.21, public_boundary, the four script tests, the adoption and grounding tests, npm test (6 passed)

Release binaries, wire diff, HTTP smoke and real-binary checks against the published 1.0.20 come next, before the tag.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.