Lead with the task, ship a runnable walkthrough, fix the version drift

[GChief117]

Acts on the cycle-8 distribution directive: turn the Glama discovery foothold into a
task-specific entry point with one copyable, tested walkthrough through a substantive
result.

Three problems, all on the only surface with verified external discovery

1. The README led with what the server is, not what it does. It now opens with
   "Verify a signed agent mandate through MCP" and the first command runs a real
   verification.

2. It advertised a command that does not resolve. npm serves 0.1.0, the version
   with the first-use defect; the README told people to run @0.1.1. There is now an
   explicit installation notice and a tested install from the release tarball with a
   checksum.

3. The server misreported its own version. createServer advertised 0.1.0 while
   package.json said 0.1.1, so the MCP initialize handshake was wrong. A test now
   pins the two together.

The walkthrough

examples/verify-mandate.mjs, run against production before this PR:

decision: requires_approval
  violation: Actions above 25000 minor units need a human approval token.
  digest: c90fd0bc104dce63…

=== 4. Tamper with one signed field, keep the signature ===
rejected: Agent Mandate error 400/invalid_request.
The tampered mandate did not buy an allow. The signature is doing its job.

The tamper step is the part that matters. A happy-path walkthrough cannot show whether
the signature is checked at all. Raising approvalRequiredAboveMinor from 25,000 to
999,999 while keeping the original signature would turn requires_approval into
allow, so the script exits non-zero if it ever succeeds.

It starts the released artifact, not the working tree, so it exercises what a
developer actually installs. The key is read from the environment or prompted for
without echo, and is never printed or written to disk.

Verification

• 29/29 tests pass, build clean
• walkthrough run end to end against production: positive PASS, tamper PASS

🤖 Generated with Claude Code