fix: make MCP quick-start guidance reliable

[jlitola]

Summary

• make quick_start the explicit session entry point for plain MCP clients
• append one universal prerequisite to every GitHits evidence and preparatory MCP descriptor: call quick_start once when the skill is absent, and skip it whenever githits-mcp is loaded
• remove the local experimental exception and the MCP skill's fallback references to the separate CLI skills
• tighten the githits-mcp trigger: load it whenever a task needs public OSS/package evidence through GitHits MCP and always before any GitHits MCP call
• align eval mocks, contract tests, skill guidance, and implementation documentation
• document that remote-mcp consumes released @githits/mcp tool logic and receives changes after dependency update and deployment

Why

Claude chat surfaces can choose tools from only the tool name and the first 80 description characters. If quick_start is skipped in a plain session, the agent misses shared routing, content, and safety guidance. The bootstrap rule must therefore be visible on every relevant discovery path and remain binary: plain session calls once; loaded MCP skill skips it.

Agent evaluation

• Codex gpt-5.6-luna, isolated full profile, neutral Express code-navigation and package/vulnerability workloads: both read githits-mcp before the first GitHits call, skipped quick_start, completed 11 MCP calls with zero CLI calls, and returned success/high confidence.
• Matching isolated plain-MCP intent workloads: quick_start was the first GitHits call exactly once in each session, followed by 17 successful MCP calls with zero CLI calls; both returned success/high confidence.
• Claude full-profile attempt discovered githits-mcp and connected the GitHits server, but the local Claude CLI was logged out and stopped before reasoning or tool use. This is recorded as blocked, not passing evidence; no authentication material was inspected or copied.

Validation

• bun test — 3,711 passed, 0 failed
• bun run build
• bun run typecheck
• bun run format:check
• bun run lint
• bun run plugins:generate
• bun run plugins:check
• bun run smoke:cli — stable and experimental live cohorts passed
• bun run smoke:mcp — stable and experimental live cohorts passed
• bun run smoke:cli:built
• bun run smoke:mcp:built
• bun run validate:packages
• pre-commit Biome checks and TypeScript typecheck
• Claude Opus reviewed the original substantive delta across three rounds; its final round was clean. The later bootstrap simplification was reviewed inline and covered by the validation and trigger evals above.

Release impact

• githits: patch
• @githits/mcp: patch