fix: v1 dist-tag must be v1-latest — npm rejects v1 (#1829)

#1828 pinned v1 publishes to `--tag v1`, following the runbook (#1804 §1). That
tag name is not legal: npm rejects any dist-tag that parses as a SemVer range,
and `v1` parses as `1.x`.

    npm error Tag name must not be a valid SemVer range: v1

Found while running the companion `npm dist-tag add` step, which failed the
same way. So the merged flag would not have "published to the wrong tag" — the
next v1 security release would have failed to publish at all, and only at
release time.

`v1-latest` is accepted (verified against semver.validRange, along with
`legacy`, which was the other candidate). The workflow comment now records both
failure modes so neither the flag nor the specific tag name gets "cleaned up"
later.


Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/main.yml

@@ -65,10 +65,15 @@ jobs:
       - name: Ensure npm CLI supports OIDC trusted publishing
         run: npm install -g npm@^11.5.1
 
-      # `publish-all` pins `--tag v1` on all four packages. Do NOT remove it:
-      # without an explicit tag npm assigns `latest`, so a v1 security release
-      # would drag `latest` back from v2 and every `npx
-      # @modelcontextprotocol/inspector` would silently get deprecated v1.
+      # `publish-all` pins `--tag v1-latest` on all four packages.
+      #
+      # Do NOT drop the flag: without an explicit tag npm assigns `latest`, so a
+      # v1 security release would drag `latest` back from v2 and every
+      # `npx @modelcontextprotocol/inspector` would silently get deprecated v1.
+      #
+      # Do NOT "simplify" the tag to `v1`: npm rejects any dist-tag that parses
+      # as a SemVer range, and `v1` does (`npm error Tag name must not be a
+      # valid SemVer range: v1`). That would fail the publish outright.
       - run: npm run publish-all
         env:
           NPM_CONFIG_PROVENANCE: "true"