Add optional cloud framework and finalize MCP v2 readiness

[blisspixel]

Summary

• Finalize the MCP compatibility matrix against stable SDK versions 1.28.1 and 2.0.0 while keeping the production dependency below v2.
• Add an optional authenticated Streamable HTTP adapter with a read-only remote tool boundary.
• Add a non-root OCI container and a draft Google Cloud Run Terraform starting point.
• Document AWS, Azure, Google, Cloudflare, Kubernetes, OpenAI, Anthropic, and generic MCP paths with explicit maturity and validation gates.
• Keep local CLI and stdio MCP as the default and label the cloud framework as draft, operator-owned, and not yet provider-validated.

Why

Users may want shared remote access to recon from the AI client of their choice. A single model-neutral MCP endpoint is the most portable direction, but the repository must not imply that a real provider deployment has already been validated. The final MCP v2 release also made the prior beta compatibility references stale.

Impact

Local installation and local CLI or stdio MCP behavior remain unchanged. The remote runtime and infrastructure are entirely optional. The Cloud Run files are a directionally useful draft, not a production-readiness claim or project-operated service.

Validation

• uv run python scripts/check.py: all stages passed
• 5,547 tests passed, 23 skipped
• 91.07 percent branch-aware coverage
• Ruff and strict Pyright passed
• Markdown links, text hygiene, workflow pins, generated artifacts, and complexity ratchets passed
• Terraform formatting, locked initialization, and validation passed with Google provider 7.42.0
• actionlint passed
• Linux container build and authenticated MCP smoke test passed locally, exposing 17 read-only tools and five resources while rejecting unauthenticated access