Enforce and document file hash requirement for MCPB packages (#368)

## Summary
Implements mandatory file hash validation for MCPB (MCP Bundle) packages
to ensure file integrity and security.

## Changes
- **Validator enforcement**: MCPB packages now require `file_sha256`
field at publish time
- **Test coverage**: Updated all MCPB test cases to include valid
SHA-256 hashes
- **Documentation**: Updated publisher guide and schema to reflect hash
requirement
- **Error handling**: Clear error message when hash is missing

## Security Impact
This ensures the complete security workflow for MCPB packages:
1. Authors generate and provide SHA-256 hashes when publishing
2. Registry validates hash is present (but doesn't verify content)
3. MCP clients validate hash matches downloaded file before installation

Fixes #351

internal/validators/registries/mcpb.go

@@ -13,6 +13,11 @@ import (
 )
 
 func ValidateMCPB(ctx context.Context, pkg model.Package, _ string) error {
+	// MCPB packages must include a file hash for integrity verification
+	if pkg.FileSHA256 == "" {
+		return fmt.Errorf("MCPB package must include a file_sha256 hash for integrity verification")
+	}
+
 	err := validateMCPBUrl(pkg.Identifier)
 	if err != nil {
 		return err