chore: 2.0.0-rc.1 (#1835)

Release candidate for the 2.0.0 go-live (#1818, §6). Publishes under the `next`
dist-tag via the derivation added in #1834 — verified: `2.0.0-rc.1` contains a
hyphen after the patch component, so it resolves to `next`, leaving `latest` on
1.0.1 untouched.

The RC exists to exercise what only exists against the live registry: the
`next`-tag publish path itself (newly written in #1834), provenance/OIDC
minting, the `files` allowlist as npm actually packs it, and the postinstall
cascade's early-exit under a real dependency install on a clean machine.


Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "2.0.0",
+  "version": "2.0.0-rc.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@modelcontextprotocol/inspector",
-      "version": "2.0.0",
+      "version": "2.0.0-rc.1",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {