chore: normalize maintained Docker MCP product

[X1pheR]

Summary

• move the maintained Docker MCP downstream delta onto the public product path from the upstream v0.3.0 baseline
• document the exact upstream relationship and maintained behavior in UPSTREAM.md / upstream.json
• replace the upstream-oriented README with external-user setup, security, compatibility and release guidance
• add a complete 19-tool docs/tools.md reference and SECURITY.md
• add locked CI, uv/GitHub Actions Dependabot configuration, weekly upstream drift detection and a tag-triggered GitHub Release workflow
• distinguish downstream package/server version 0.3.0+x1pher.1 from upstream 0.3.0
• format the existing maintained safety delta without changing its behavior
• refresh only advisory-related locked dependencies and deliberately exclude the optional Paramiko-backed ssh:// Docker transport while released Paramiko versions remain affected by GHSA-r374-rxx8-8654

Downstream behavior retained

• bounded attached/log output
• configuration-preserving recreate_container with best-effort rollback
• deterministic Docker build-intermediate cleanup
• omission of unset nested Docker filter values

Upstream PRs ckreiling#59, ckreiling#60 and ckreiling#61 remain the tracked generic contributions; the recreate policy and 20 KiB output bound remain downstream behavior.

Security/dependency disposition

• Secret Scanning and Push Protection enabled
• CodeQL default setup enabled for Python
• initial Dependabot scan exposed stale locked dependencies; the branch updates only cryptography, python-multipart, requests, urllib3 and the required cffi transitive dependency
• Paramiko, PyNaCl and bcrypt leave the dependency graph because Docker-over-SSH is not used by the maintained deployment and Paramiko has no released patched version for GHSA-r374-rxx8-8654
• ssh:// Docker endpoints are explicitly unsupported by this downstream release until a patched Paramiko release is available
• no Dependabot PR was auto-merged

Verification

• uv sync --frozen --all-groups
• 13 pytest tests pass
• ruff format --check src tests
• ruff check src tests
• package/server/project versions agree at 0.3.0+x1pher.1
• two independent wheel builds are byte-identical
• current-tree and downstream-history private-path/secret-marker review is clean
• candidate direct STDIO smoke against the live Docker Engine exposes 19 tools and a successful read-only list_containers

No tag, GitHub Release, MCPJungle registration or Docker workload was changed by this PR.