Enforce and document file hash requirement for MCPB packages (#368)

## Summary
Implements mandatory file hash validation for MCPB (MCP Bundle) packages
to ensure file integrity and security.

## Changes
- **Validator enforcement**: MCPB packages now require `file_sha256`
field at publish time
- **Test coverage**: Updated all MCPB test cases to include valid
SHA-256 hashes
- **Documentation**: Updated publisher guide and schema to reflect hash
requirement
- **Error handling**: Clear error message when hash is missing

## Security Impact
This ensures the complete security workflow for MCPB packages:
1. Authors generate and provide SHA-256 hashes when publishing
2. Registry validates hash is present (but doesn't verify content)
3. MCP clients validate hash matches downloaded file before installation

Fixes #351

internal/validators/registries/mcpb.go

@@ -13,6 +13,11 @@ import (
 )
 
 func ValidateMCPB(ctx context.Context, pkg model.Package, _ string) error {
+	// MCPB packages must include a file hash for integrity verification
+	if pkg.FileSHA256 == "" {
+		return fmt.Errorf("MCPB package must include a file_sha256 hash for integrity verification")
+	}
+
 	err := validateMCPBUrl(pkg.Identifier)
 	if err != nil {
 		return err

internal/validators/registries/mcpb_test.go

@@ -16,6 +16,7 @@ func TestValidateMCPB(t *testing.T) {
 		name         string
 		packageName  string
 		serverName   string
+		fileSHA256   string
 		expectError  bool
 		errorMessage string
 	}{
@@ -23,18 +24,29 @@ func TestValidateMCPB(t *testing.T) {
 			name:        "valid MCPB package should pass",
 			packageName: "https://github.com/domdomegg/airtable-mcp-server/releases/download/v1.7.2/airtable-mcp-server.mcpb",
 			serverName:  "io.github.domdomegg/airtable-mcp-server",
+			fileSHA256:  "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce",
 			expectError: false,
 		},
 		{
 			name:        "valid MCPB package should pass",
 			packageName: "https://github.com/microsoft/playwright-mcp/releases/download/v0.0.36/playwright-mcp-extension-v0.0.36.zip",
 			serverName:  "com.microsoft/playwright-mcp",
+			fileSHA256:  "abc123ef4567890abcdef1234567890abcdef1234567890abcdef1234567890",
 			expectError: false,
 		},
 		{
-			name:         "valid MCPB package with .mcpb extension should fail accessibility check",
+			name:         "MCPB package without file hash should fail",
 			packageName:  "https://github.com/example/server/releases/download/v1.0.0/server.mcpb",
 			serverName:   "com.example/test",
+			fileSHA256:   "",
+			expectError:  true,
+			errorMessage: "must include a file_sha256 hash for integrity verification",
+		},
+		{
+			name:         "non-existent .mcpb package should fail accessibility check",
+			packageName:  "https://github.com/example/server/releases/download/v1.0.0/server.mcpb",
+			serverName:   "com.example/test",
+			fileSHA256:   "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce",
 			expectError:  true,
 			errorMessage: "not publicly accessible",
 		},
@@ -42,6 +54,7 @@ func TestValidateMCPB(t *testing.T) {
 			name:         "invalid URL without mcp anywhere should fail",
 			packageName:  "https://github.com/example/server/releases/download/v1.0.0/server.tar.gz",
 			serverName:   "com.example/test",
+			fileSHA256:   "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce",
 			expectError:  true,
 			errorMessage: "URL must contain 'mcp'",
 		},
@@ -49,6 +62,7 @@ func TestValidateMCPB(t *testing.T) {
 			name:         "invalid URL format should fail",
 			packageName:  "not://a valid url for mcpb!",
 			serverName:   "com.example/test",
+			fileSHA256:   "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce",
 			expectError:  true,
 			errorMessage: "invalid MCPB package URL",
 		},
@@ -56,6 +70,7 @@ func TestValidateMCPB(t *testing.T) {
 			name:         "non-existent file should fail accessibility check",
 			packageName:  "https://github.com/nonexistent/repo/releases/download/v1.0.0/mcp-server.tar.gz",
 			serverName:   "com.example/test",
+			fileSHA256:   "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce",
 			expectError:  true,
 			errorMessage: "not publicly accessible",
 		},
@@ -66,6 +81,7 @@ func TestValidateMCPB(t *testing.T) {
 			pkg := model.Package{
 				RegistryType: model.RegistryTypeMCPB,
 				Identifier:   tt.packageName,
+				FileSHA256:   tt.fileSHA256,
 			}
 
 			err := registries.ValidateMCPB(ctx, pkg, tt.serverName)