chore: pin v1 publishes to the v1 dist-tag (#1828)

`publish-all` had no `--tag`, so npm assigned `latest` to whatever it
published. That was correct for 1.0.1 — the deprecation release had to take
`latest` to reach npx users — but it becomes a trap the moment 2.0.0 ships: a
1.0.2 security fix published from `v1/main` would move `latest` back to v1, and
every `npx @modelcontextprotocol/inspector` in the world would silently get the
deprecated line.

`--tag v1` on both halves covers all four package names — `--workspaces` fans
out to inspector-client/-server/-cli, and the second invocation is the root.

Nothing enforces this flag, and the cost of dropping it surfaces months later
in a way that looks like an npm bug rather than a missing argument, so the
workflow carries a comment at the point of use.

Phase 3 of the v2 go-live runbook (#1804 §1).


Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/main.yml

@@ -65,6 +65,10 @@ jobs:
       - name: Ensure npm CLI supports OIDC trusted publishing
         run: npm install -g npm@^11.5.1
 
+      # `publish-all` pins `--tag v1` on all four packages. Do NOT remove it:
+      # without an explicit tag npm assigns `latest`, so a v1 security release
+      # would drag `latest` back from v2 and every `npx
+      # @modelcontextprotocol/inspector` would silently get deprecated v1.
       - run: npm run publish-all
         env:
           NPM_CONFIG_PROVENANCE: "true"

package.json

@@ -47,7 +47,7 @@
     "prettier-check": "prettier --check .",
     "lint": "prettier --check . && cd client && npm run lint",
     "prepare": "husky && npm run build",
-    "publish-all": "npm publish --workspaces --access public && npm publish --access public",
+    "publish-all": "npm publish --workspaces --access public --tag v1 && npm publish --access public --tag v1",
     "update-version": "node scripts/update-version.js",
     "check-version": "node scripts/check-version-consistency.js"
   },