ci: add AgentScore MCP dependency policy gate

[Thezenmonster]

What this does

Adds a GitHub Actions workflow that checks MCP package dependencies on every PR and push to master.

The Action auto-discovers MCP packages from:

• `package.json` dependencies
• MCP config files (`.mcp.json`, `mcp.json`, `.cursor/mcp.json`)

For your repo, it will detect and scan:

• `@upstash/context7-mcp` (from `.mcp.json`)
• `@modelcontextprotocol/server-sequential-thinking` (from `.mcp.json`)

What is NOT covered

`serena` is installed via `uvx --from git+https://github.com/oraios/serena\`. This is not an npm package and cannot be scanned. The Action will log a warning:

```
serena: git URL install (not an npm package). Not scannable by AgentScore.
```

How it works

• No API key needed. Authenticates via GitHub OIDC.
• First run auto-provisions the repo.
• Shows per-package trust verdicts and AI capability classification.

To try it

Merge this PR. Push to master. The gate runs automatically.

Ref: #5575

---

Free 30-day pilot. No lock-in. Remove the workflow file anytime.

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}