fix: pin mcp shim to matching core

[wbugitlab1]

Summary

• change @agentmemory/mcp to use workspace:* for the core dependency so pnpm packs an exact matching dependency
• bump coordinated release/version surfaces to 0.9.28 because 0.9.27 is already published with bad MCP metadata
• update contract tests and release docs so future MCP shim releases keep exact core alignment

Fixes #267.

Verification

• corepack pnpm exec vitest run test/quality-gates.test.ts test/plugin-surface-contract.test.ts
• corepack pnpm exec vitest run test/quality-gates.test.ts test/plugin-surface-contract.test.ts test/consistency.test.ts test/export-import.test.ts test/deploy-version-contract.test.ts test/copilot-plugin.test.ts test/codex-plugin.test.ts test/factory-plugin.test.ts
• MCP pack tarball inspection printed 0.9.28 and 0.9.28
• corepack pnpm test
• git diff --check
• osv-scanner scan source .
• semgrep scan --config p/default --error --metrics=off .
• gitleaks protect --staged --redact

Notes

• origin/main was fetched before PR creation and remained at base SHA eacce17ea273b2d07ab120d910f3685d8f42cc48.
• No base merge was needed because the branch is already based on current origin/main.