fix(container): build the image from source, publish to the MCP Registry

[adacapo21]

Two things, both about distribution. Neither touches the Smithery publishing path.

The container build has never worked

Dockerfile:                COPY .smithery/hosted/server.mjs ./server.mjs
scripts/smithery-build.sh: writes .smithery/stdio/index.js

Nothing in this repo produces .smithery/hosted/ — that path comes from Smithery's own CLI build for its hosted runtime. So docker build fails on a missing file, and since fly.toml has an empty [build] section and defers to the Dockerfile, fly deploy fails for the same reason. This is independent of Smithery credits or outages; it would fail with a full balance.

The image now builds from source in two stages — esbuild via scripts/build.sh, then a runtime layer with only the three packages left external to the bundle (libsodium-sumo, libsodium-wrappers-sumo, undici) plus dist/. Nothing outside this repo is required to produce it, so the same image works on Fly, on any container host, and locally.

Also added .dockerignore. The build context was 363 MB across 28,573 files — node_modules 260 MB, a 64 MB local indigo-mcp-darwin-arm64 binary, .git 26 MB — uploaded to the builder on every deploy.

Smithery is untouched. smithery.yaml and scripts/smithery-build.sh still produce the stdio MCPB bundle that pnpm smithery:publish uploads. The README now spells out which build produces which artifact, because conflating them is exactly what broke the Dockerfile.

The MCP Registry listing is five months stale

	version
npm	0.4.0 (today)
server.json in this repo	0.2.2
the live registry entry	0.2.1, published 8 March, never updated

io.github.IndigoProtocol/indigo-mcp is active in the official registry — the one Claude, VS Code and other clients read — and it has been advertising a build from before the read tools moved to /api/v3. Anyone installing from there gets the version that 404s on everything.

server.json is corrected to 0.4.0, and CI now publishes to the registry on a v* tag so it cannot drift again. Two details worth reviewing:

• The job is needs: publish. The registry verifies ownership by fetching the npm package and checking its mcpName field, so the version has to be on npm before this runs.
• Authentication is GitHub OIDC (id-token: write), not a token. Given NPM_TOKEN expired and silently broke the 0.4.0 release this morning, one less credential with an expiry date is the point.

The job also rewrites server.json from the tag before publishing, so the committed value is documentation rather than something that has to be remembered.

Verification

Docker's daemon was not running locally, so both stages were reproduced by hand instead: a clean directory containing only the files the Dockerfile copies builds successfully and produces dist/ plus the three WASM files; a second directory with pnpm install --prod resolves to exactly the three runtime packages, and node dist/index.js boots and answers:

{"status":"ok","server":"indigo-mcp","version":"0.4.0"}

Worth one real docker build before merging to confirm the container layer itself — everything inside it is verified.

Suite: 144 passing; typecheck, lint and format clean.