feat: 薄殼原則落地 + seed 下沉 API + MCP 進主庫 + 部署一致性

壓測四橫向問題修正（docs 壓測報告）：

① 薄殼原則成鐵律：能力長在 API，CLI/MCP/lib 只暴露
   - seed 下沉成 API 行為：cypher-executor POST /init/seed（一次灌 API+auth recipe），
     種子資料移到 server src/lib/api-recipe-seeds.ts，CLI 改薄殼一次呼叫
   - 解除 deployFullyOk 連坐 + init 補 seed auth recipe + update 補 seed/全 KV
   - registry SUBMISSIONS_KV 補進 REQUIRED_KV_NAMESPACES（修 20/21）

② MCP 統一帳號來源（單一 remote MCP + .env 切 MCP URL）
   - MCP 從 sibling repo 搬進 arcrun/mcp/（remote Worker，route 改 mcp.arcrun.dev）
   - config 加 mcp_url 三層解析 + getMcpUrl + DEFAULT_MCP_URL
   - 新增 acr mcp-setup：依 config 寫專案 .mcp.json（接案切資料夾自動切 MCP）
   - acr --version 改動態讀 package.json（根治漂移）

③ Deploy 一致性
   - tests/release.feature + scripts/check-release.sh
   - local-deploy.sh：CLI npm publish + auto patch bump + CHANGELOG
   - local-deploy.sh bash 3.2 相容修正（mapfile / 空陣列 set -u）
   - builtins/pnpm-lock.yaml

④ README self-hosted 同步現況（移除 R2 殘留、加 flag/env、多帳號）

CLI bump → 1.3.0

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

mcp/tests/unit/tools/list-workflows.test.ts

@@ -0,0 +1,48 @@
+import { describe, it, expect } from "vitest";
+
+// Unit tests for workflow metadata record structure and ID conventions
+
+describe("workflow metadata: record ID format", () => {
+  it("workflow record ID is prefixed with 'wf-'", () => {
+    const workflowId = "abc123";
+    const recordId = `wf-${workflowId}`;
+    expect(recordId).toBe("wf-abc123");
+    expect(recordId.startsWith("wf-")).toBe(true);
+  });
+
+  it("record ID is deterministic for the same workflow_id", () => {
+    const workflowId = "my-workflow";
+    expect(`wf-${workflowId}`).toBe(`wf-${workflowId}`);
+  });
+});
+
+describe("workflow metadata: required fields", () => {
+  it("workflow_metadata record contains required fields", () => {
+    const record = {
+      workflow_id: "wf-abc",
+      name: "My Workflow",
+      deployed_at: new Date().toISOString(),
+      org_namespace: "org-test",
+    };
+    expect(record.workflow_id).toBeTruthy();
+    expect(record.name).toBeTruthy();
+    expect(record.deployed_at).toMatch(/^\d{4}-\d{2}-\d{2}T/);
+    expect(record.org_namespace).toBeTruthy();
+  });
+
+  it("deployed_at is ISO 8601 format", () => {
+    const ts = new Date().toISOString();
+    expect(ts).toMatch(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/);
+  });
+});
+
+describe("workflow metadata: namespace isolation", () => {
+  it("get workflow query URL includes org_namespace", () => {
+    const orgNamespace = "org-test";
+    const workflowId = "abc123";
+    const recordId = `wf-${workflowId}`;
+    const url = `http://kbdb/records/${encodeURIComponent(recordId)}?org_namespace=${encodeURIComponent(orgNamespace)}`;
+    expect(url).toContain("org-test");
+    expect(url).toContain("wf-abc123");
+  });
+});

mcp/tests/unit/tools/tag-management.test.ts

@@ -0,0 +1,53 @@
+import { describe, it, expect } from "vitest";
+
+// Unit tests for tag management logic
+// Validates tag name constraints and resource_tag record structure
+
+describe("tag management: name validation", () => {
+  it("accepts non-empty tag names", () => {
+    const validNames = ["frontend", "v2", "my-tag", "tag_123"];
+    for (const name of validNames) {
+      expect(name.length).toBeGreaterThan(0);
+    }
+  });
+
+  it("tag record ID format is deterministic", () => {
+    // Tags are stored as blocks; resource_tag records link resources to tags
+    const orgNamespace = "org-test";
+    const tagName = "frontend";
+    const encoded = encodeURIComponent(tagName);
+    expect(encoded).toBe("frontend");
+  });
+});
+
+describe("tag management: resource_tag record structure", () => {
+  it("resource_tag record contains required fields", () => {
+    const record = {
+      resource_type: "workflow" as const,
+      resource_id: "wf-abc123",
+      tag_name: "frontend",
+      org_namespace: "org-test",
+    };
+    expect(record.resource_type).toBe("workflow");
+    expect(record.resource_id).toBeTruthy();
+    expect(record.tag_name).toBeTruthy();
+    expect(record.org_namespace).toBeTruthy();
+  });
+
+  it("resource_type is either workflow or component", () => {
+    const validTypes = ["workflow", "component"];
+    expect(validTypes).toContain("workflow");
+    expect(validTypes).toContain("component");
+    expect(validTypes).not.toContain("tag");
+  });
+});
+
+describe("tag management: namespace isolation", () => {
+  it("different org_namespaces produce different query URLs", () => {
+    const orgA = "org-a";
+    const orgB = "org-b";
+    const urlA = `http://kbdb/blocks?type=tag&user_id=${encodeURIComponent(orgA)}`;
+    const urlB = `http://kbdb/blocks?type=tag&user_id=${encodeURIComponent(orgB)}`;
+    expect(urlA).not.toBe(urlB);
+  });
+});