feat: add replay-verified JSON reduction

[bm1016bm-svg]

What changed

• add ReproMin commands for zero-setup demo, bounded JSON request reduction, and one-shot artifact replay
• keep replay isolated from contract checks and MCP, with literal-loopback confinement, explicit confirmation, strict predicates, resource limits, and content-addressed artifacts
• harden the two-tool STDIO MCP runtime and remove its unused HTTP stack from production dependencies
• add a Marketplace-ready contract-check Action, reproduction issue template, runnable fixture, English/Traditional Chinese docs, Pages updates, and v0.4.0 release metadata
• strengthen release readback, runtime dependency auditing, package tests, security tests, and UAT evidence

Why

This combines minimal failure reproduction with Evidrift's existing contract-drift evidence in one flagship developer tool. The workflows stay deliberately separate: ReproMin replays only explicit local fixtures, while evidrift check and MCP remain network-free.

Validation

• npm run verify — 89/89 tests, smoke test, and repository Receipt check passed
• npm run release:check -- v0.4.0
• runtime-only and complete npm audit against the official registry — 0 known vulnerabilities at test time
• clean tarball install — CLI version/demo passed and official MCP SDK 1.29.0 listed both tools
• targeted security re-review confirmed all four discovered blockers were fixed

Limits

ReproMin does not claim a global minimum, root cause, harmless side effects, or correctness beyond the selected status plus error identity. The reproduction fixture should use synthetic data and a disposable local target.