feat: publish SideShift Cursor MCP plugin

[nevjin]

Summary

• add a Cursor Marketplace-ready plugin manifest for the hosted SideShift MCP server
• add safe capability-discovery guidance and a connection command
• commit a square repo-owned logo, privacy disclosure, Apache-2.0 license, security policy, support paths, and contributor guidance
• add offline package validation, live credential-free OAuth discovery smoke testing, CI, and scheduled endpoint monitoring

Dependencies

• SideShiftApp/sideshift-monorepo#2847: merged, deployed, and verified; permits only Cursor MCP's exact native OAuth callback
• SideShiftApp/sideshift-monorepo#2851: merged, deployed, and verified; defaults trusted Cursor DCR clients that omit scope to the protected resource's advertised public scopes

Verification

• npm run check: passed
• npm run smoke: passed; 401 challenge, protected-resource metadata, OAuth issuer, DCR, and PKCE S256 verified
• git diff --check: passed
• public policy/support URLs: HTTP 200
• repository secret-pattern scan: clean
• local Cursor 3.16.17: plugin discovered with 1 MCP, 267 enabled tools, 1 skill, and 1 command
• live DCR and native callback compatibility: passed
• authenticated read-only verification: passed against Dev Testing Don (company Dsc8SfHtPjzNGDKzMqBP)
• whoami and company-status tools returned the correct tenant; no write operation was performed

Marketplace readiness

• no committed credentials or environment placeholders
• remote HTTPS MCP transport
• OAuth 2.1 authorization code flow with PKCE
• Apache-2.0 licensed and free plugin package
• repository-owned 1024x1024 PNG logo with background plate
• privacy, terms, support, and private vulnerability-reporting paths documented