fix: v2.0.1 release — fix broken installs, CI, security, and docs

Critical fixes:
- npm postinstall.js: BINARY_VERSION '1.1.3' → '2.0.1' (every install was 404ing)
- npm package name: corrected error messages to 'vestige-mcp-server'
- README: npm install command pointed to wrong package
- MSRV: bumped from 1.85 to 1.91 (uses floor_char_boundary from 1.91)
- CI: removed stale 'develop' branch from test.yml triggers

Security hardening:
- CSP: restricted connect-src from wildcard 'ws: wss:' to localhost-only
- Added X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy headers
- Added frame-ancestors 'none', base-uri 'self', form-action 'self' to CSP
- Capped retention_distribution endpoint from 10k to 1k nodes
- Added debug logging for WebSocket connections without Origin header

Maintenance:
- All clippy warnings fixed (58 total: redundant closures, collapsible ifs, no-op casts)
- All versions harmonized to 2.0.1 across Cargo.toml and package.json
- CLAUDE.md updated to match v2.0.1 (21 tools, 29 modules, 1238 tests)
- docs/CLAUDE-SETUP.md updated deprecated function names
- License corrected to AGPL-3.0-only in root package.json

1,238 tests passing, 0 clippy warnings.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

crates/vestige-core/src/codebase/git.rs

@@ -274,11 +274,10 @@ impl GitAnalyzer {
                 if let Some(path) = delta.new_file().path() {
                     files.push(path.to_path_buf());
                 }
-                if let Some(path) = delta.old_file().path() {
-                    if !files.contains(&path.to_path_buf()) {
+                if let Some(path) = delta.old_file().path()
+                    && !files.contains(&path.to_path_buf()) {
                         files.push(path.to_path_buf());
                     }
-                }
             }
         }
 
@@ -492,11 +491,10 @@ impl GitAnalyzer {
                 .single()
                 .unwrap_or_else(Utc::now);
 
-            if let Some(since_time) = since {
-                if commit_time < since_time {
+            if let Some(since_time) = since
+                && commit_time < since_time {
                     continue;
                 }
-            }
 
             let message = commit.message().map(|m| m.to_string()).unwrap_or_default();