docs: clarify commit hash update and image build process

[samerfarida]

What

This PR adds comprehensive documentation to clarify how commit hash/pin updates work and when Docker images are built after updates.

Why

Users were confused about:

• Whether they need to manually create PRs when updating their MCP server
• When Docker images are actually built and published after pin update PRs are merged
• The complete lifecycle from pin update to image availability in Docker Hub
• Lack of visibility into the publishing process and timeline

Changes

CONTRIBUTING.md

• Added new "Updating Your MCP Server" section with:
  • Detailed explanation of automated vs manual update options
  • Complete lifecycle: automated pin update → PR creation → merge → image build → publication
  • Timeline expectations (24 hours after PR merge)
  • Requirements for automated updates (mcp/ namespace, GitHub-hosted, etc.)
  • Manual update process with git command example: git ls-remote https://github.com/<username/orgname>/mcp-repo-name.git HEAD | awk '{print $1}'
  • Troubleshooting Q&A for common questions
• Updated section 4 to reference the new section and clarify the post-merge process

docs/configuration.md

• Enhanced "Source Pinning" section to explain:
  • How automated updates work (nightly GitHub Action checks)
  • What happens after PR merge (image build, signing, SBOM generation)
  • Timeline clarification (24 hours)
  • Link to CONTRIBUTING.md for more details

README.md

• Added FAQ section answering:
  • How to update MCP server versions
  • Timeline for image availability
  • Why automated PRs might not appear immediately

Impact

This documentation will help users understand:

• They don't need to manually create PRs for Docker-built images - the automated system handles it
• The expected timeline (24 hours) for image availability after pin updates
• How to manually update if needed (with practical git command example)
• Why their automated PR might not have appeared yet (daily schedule)
• When updates are triggered (daily at 5 AM UTC) and when they complete (24h after PR merge)
• How to check if pin update PRs were created

Related Issues

Fixes #757 - Fully addresses the request for documentation on the update process

Partially addresses #484 - Improves visibility through documentation:

• ✅ Documents when updates are triggered/completed
• ✅ Documents how to manually trigger updates via PR
• ✅ Provides troubleshooting guidance for checking PR status
• ⚠️ Does not address notifications for build failures (requires feature implementation)
• ⚠️ Does not address Docker Scout Health Score documentation (separate topic)
• ⚠️ Does not provide actual pipeline status/logs access (requires tooling)

[samerfarida]

This PR resolves the documentation requests in issue #757. The documentation now clearly explains:

• Whether to update commit hash in fork vs creating a PR
• The automated update process (no manual PR needed for Docker-built images)
• The complete update workflow and timeline
• How to manually trigger updates when needed

Fixes #757

[yzxbmlf]

Thank you Sammy! This documentation is much needed. I'm still stuck trying to get the latest version published in the MCP Registry for my MCP server. If the Docker team could help, that would be appreciated. (https://github.com/Cylera/cylera-mcp-server)