release skill: add a final v1 step that walks the maintainer through npm deprecate #2954

Problem

npm deprecate is a point-in-time write, not a standing rule, so every v1 release lands on npm un-deprecated unless someone remembers to run it by hand. 1.0.2 shipped that way and was fixed after the fact (#2080). #2104 proposed automating it in v1/main's publish job, but that needs a long-lived npm token: OIDC trusted publishing covers npm publish only. Maintainers decided not to add and manage one, so #2104 was closed as not planned.

Deprecation therefore stays manual. Today the release skill's v1 flow (.claude/skills/release/SKILL.md, "The v1 line", steps v1-1 to v1-6) never mentions it, so the step relies on memory and has already been forgotten.

Proposal

Add a final step to the v1 flow that walks the maintainer through deprecating the version they just published. It goes after v1-5 (Verify), which confirms the publish actually landed. The step should cover:

• Exact version, all four packages. Deprecate @modelcontextprotocol/{inspector,inspector-cli,inspector-client,inspector-server}@X.Y.Z.
• ⚠️ Never a range. <2.0.0 also matches 2.0.0-rc.1/2/3 (a prerelease sorts below its release), so those v2 release candidates would get a v1 notice. If a range is ever genuinely needed, the safe spelling is <2.0.0-0.
• The message, verbatim. It must match what is already on every v1 version. Read it back with npm view @modelcontextprotocol/inspector@<previous> deprecated rather than retyping it:
  v1 is deprecated. Upgrade to v2: npm i @modelcontextprotocol/inspector@latest. v1 gets security fixes only, published under the v1-latest tag.
• ⚠️ An empty message lifts deprecation. npm deprecate pkg@ver "" un-deprecates, so a quoting slip silently reverses the step.
• It is a human step. The publishing account requires 2FA for writes, so npm deprecate fails with EOTP unless given an OTP. An agent driving the release should stop and hand the maintainer the four exact commands (for example via ! npm deprecate … --otp=<code>), not attempt them itself. A TOTP code can expire between commands, so expect to supply fresh codes.
• Verify. Check npm view @modelcontextprotocol/<pkg>@X.Y.Z deprecated --prefer-online for each of the four, and confirm 2.0.0-rc.* and the current latest stay un-deprecated.

Consider also listing the step in the v1 release issue's checklist, so the release isn't closed until it's done.

Acceptance criteria

• The release skill's v1 flow ends with a deprecate step covering everything above
• The step targets only the exact version just published and warns against the <2.0.0 range
• The step states the message verbatim (or how to read it back) and warns that an empty message lifts deprecation
• The step is framed as maintainer-run (2FA/OTP), with a verification command

Context

• v1: automate npm deprecate in the main.yml publish job so v1 releases ship deprecated #2104: automation proposal, closed not planned (no long-lived npm token)
• v1: release 1.0.2 with the pending security and audit fixes #2080: the 1.0.2 release that shipped un-deprecated
• go-live 3/9: lock the v1 dist-tag and deprecate all four packages on npm #1816 / chore: v1 deprecation notices in all four packages, bump to 1.0.1 #1827: the original deprecation run and the shared notice wording