fix: v2.0.1 release — fix broken installs, CI, security, and docs

Critical fixes:
- npm postinstall.js: BINARY_VERSION '1.1.3' → '2.0.1' (every install was 404ing)
- npm package name: corrected error messages to 'vestige-mcp-server'
- README: npm install command pointed to wrong package
- MSRV: bumped from 1.85 to 1.91 (uses floor_char_boundary from 1.91)
- CI: removed stale 'develop' branch from test.yml triggers

Security hardening:
- CSP: restricted connect-src from wildcard 'ws: wss:' to localhost-only
- Added X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy headers
- Added frame-ancestors 'none', base-uri 'self', form-action 'self' to CSP
- Capped retention_distribution endpoint from 10k to 1k nodes
- Added debug logging for WebSocket connections without Origin header

Maintenance:
- All clippy warnings fixed (58 total: redundant closures, collapsible ifs, no-op casts)
- All versions harmonized to 2.0.1 across Cargo.toml and package.json
- CLAUDE.md updated to match v2.0.1 (21 tools, 29 modules, 1238 tests)
- docs/CLAUDE-SETUP.md updated deprecated function names
- License corrected to AGPL-3.0-only in root package.json

1,238 tests passing, 0 clippy warnings.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/vestige-init/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vestige/init",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "Give your AI a brain in 10 seconds — zero-config Vestige v2.0 installer with 3D dashboard",
   "bin": {
     "vestige-init": "bin/init.js"

packages/vestige-mcp-npm/README.md

@@ -1,4 +1,4 @@
-# @vestige/mcp
+# vestige-mcp-server
 
 Vestige MCP Server - A synthetic hippocampus for AI assistants.
 
@@ -120,10 +120,10 @@ Fix the MCP connection first, then the model will download automatically.
 
 | Platform | Architecture |
 |----------|--------------|
-| macOS | ARM64 (Apple Silicon) |
+| macOS | ARM64 (Apple Silicon), x86_64 (Intel) |
 | Linux | x86_64 |
 | Windows | x86_64 |
 
 ## License
 
-MIT
+AGPL-3.0-only

packages/vestige-mcp-npm/bin/vestige-mcp.js

@@ -13,7 +13,7 @@ if (!fs.existsSync(binaryPath)) {
   console.error('Error: vestige-mcp binary not found.');
   console.error(`Expected at: ${binaryPath}`);
   console.error('');
-  console.error('Try reinstalling: npm install -g @vestige/mcp');
+  console.error('Try reinstalling: npm install -g vestige-mcp-server');
   process.exit(1);
 }
 

packages/vestige-mcp-npm/bin/vestige.js

@@ -13,7 +13,7 @@ if (!fs.existsSync(binaryPath)) {
   console.error('Error: vestige CLI binary not found.');
   console.error(`Expected at: ${binaryPath}`);
   console.error('');
-  console.error('Try reinstalling: npm install -g @vestige/mcp');
+  console.error('Try reinstalling: npm install -g vestige-mcp-server');
   process.exit(1);
 }
 

packages/vestige-mcp-npm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vestige-mcp-server",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "Vestige MCP Server — Cognitive memory for AI with FSRS-6, 3D dashboard, and 29 brain modules",
   "bin": {
     "vestige-mcp": "bin/vestige-mcp.js",

packages/vestige-mcp-npm/scripts/postinstall.js

@@ -7,7 +7,7 @@ const os = require('os');
 const { execSync } = require('child_process');
 
 const VERSION = require('../package.json').version;
-const BINARY_VERSION = '1.1.3'; // GitHub release version for binaries
+const BINARY_VERSION = '2.0.1'; // GitHub release version for binaries
 const PLATFORM = os.platform();
 const ARCH = os.arch();