docs: say how SecID actually deploys and verifies, and record the /mcp method contract

[kurtseifried]

The README's Deployment section said Cloudflare Workers Builds deployed on
push with no test gate (#28). It does not: since at least 2026-09-25 every
production deployment matches one run of registry-kv-upload.yml, which runs
the unit tests before deploying and, since #41, the Playwright suite against
production after. CLAUDE.md said the opposite of the README; both now say
what happens.

• README: Deployment rewritten — merge to main deploys; the four steps of the
  workflow; ci.yml gates PRs and never deploys; a post-deploy failure means
  the new version is live, with the rollback command; how to confirm a
  deploy; a dated correction note for the Workers Builds claim. New "MCP
  endpoint behaviour" table. CORS line states methods and no credentials.
  Break-glass deploys now say to run the verification by hand.
• CLAUDE.md: four MCP tools, not three (submit_feedback was missing);
  method-gate.ts, e2e/ and ci.yml in the structure; deploy chain gains the
  post-deploy verification and the merge-deploys fact; the "405 GET/DELETE"
  design note becomes the full method contract, pointing at Core's copy.
• AGENTS.md: e2e is the post-deploy gate; tag third-party tests; changing
  method handling means both test files and Core's table.
• DECISIONS.md: ADR-015 (the method contract, with the rejected
  alternatives — including why this is a local copy, not an import from
  private Core); ADR-008 updated for the post-deploy gate.
• OPERATIONAL-RESOURCES.md: runbook and health check match the pipeline.
• src/resolver.ts, src/types.ts: comments citing "ADR-015" now say "SecID
  spec ADR-015" — that decision lives in the spec repo, and this repo now
  has its own ADR-015. Comment-only.