[RFingAdam]

Gets lineforge ready for its first PyPI release, 2.3.0. Refs #16.

What changed

• MCP SDK: ported from mcp 1 (FastMCP) to mcp>=2.2,<3 (MCPServer). The tool names and arguments are the same. The SDK now runs sync tools in a worker thread, so solve_cgp, solve_lrs, solve_full, sweep, and tasks_cancel are async. Without that, starting a background task raises no running event loop.
• Rust: pyo3 0.22 to 0.29 and crossbeam-epoch to 0.9.21. The numpy crate had no users and held pyo3 back, so it is gone. MSRV moves to 1.83.
• Python lock: patched certifi, cryptography, pillow, pyjwt, and urllib3. Pillow's floor rises to 13.0 because from_bmp parses user files.
• Release workflow: rewritten. A v* tag on main builds the sdist and all wheels, runs each wheel on its own platform, then publishes through a trusted publisher. Actions are pinned by SHA, the build is --locked, and maturin is pinned. TestPyPI and the manual dispatch are gone.
• README: links are absolute so they work on the PyPI page. The install docs still say "not on PyPI" and change after the first upload.

Checked locally

• uv lock: pip-audit finds no known vulnerabilities (61 before).
• Cargo.lock: 39 crates, no OSV advisories (6 before).
• The sdist and x86_64 wheel from maturin 1.16.0 contain no denylist hits, employer or customer names, or secrets. The sdist has src, crates, and metadata only.
• cargo test --workspace passes, and the full pytest suite gives 720 passed, 12 skipped.

Checked in this PR's CI

• The sdist and all 4 wheels build, and each wheel loads the kernel and solves a line on its own platform: Linux x86_64 (Python 3.11 and 3.14), Linux aarch64, macOS arm64 and Intel, and Windows x64.
• A wheel rebuilt from the sdist loads, and twine check --strict passes.
• publish and github-release are skipped because they only run on a tag.

Before tagging

Register the pending publisher in docs/release/PYPI_TRUSTED_PUBLISHER.md. The pypi environment and the "Release tags" ruleset are already set on this repo.