Validate maintained provider contracts without credentials

[zackbart]

Summary

• add credential-free public contract validation across all seven maintained providers
• let Cloudflare, Notion, and Vercel deployments explicitly choose the maintained API interface or official hosted MCP while preserving API defaults
• keep live MCP descriptions and schemas authoritative, fill only reviewed safety annotations, and keep unknown tools fail-closed
• refresh Stripe, RevenueCat, and Vercel contract evidence and prepare patch release 0.22.2

Independent review

Claude Opus 5 reviewed the complete pre-release diff. The release candidate incorporates its actionable findings: version and changelog preparation, Vercel open-event output handling, conservative Vercel URL-fetch classification, extendable legacy option interfaces, consistent MCP call-admission options, corrected RevenueCat claims, stale schema-digest prose, and complete proxy audit coverage. Its unverified Notion live-catalog observation was not promoted into the credential-free contract; official docs remain the public check and unknown live tools still fail closed.

Verification

• npm run release:check
• npm run providers:check
• 120 test suites; 2,932 passed, 40 skipped
• npm audit: 0 vulnerabilities
• package smoke: passed; Docker-only generated-container branch skipped because Docker is unavailable locally

Closes #521
Closes #520