chore: release v0.3.8

- README: add Validation section citing Lighthouse 13.3.0 agentic-browsing
  audit (passes the full category on Chrome Canary 150.x).
- chore: bump test toolchain to clear all Dependabot advisories
  (vitest 2->4, vitest-pool-workers 0.5->0.16, wrangler 4.90->4.95).
  Migrated vitest.config.ts to the cloudflareTest() plugin pattern per
  Cloudflare's official v3->v4 codemod. 0 vulnerabilities.
- docs/scope.md + README: adopt items from the specification.website
  cross-review - add A2A agent cards out-of-scope entry, add Adjacent
  agent-readiness surfaces sub-section, cite specification.website in
  Acknowledgements as an independent converging reference.
- src/link-header.ts: add RFC 8288 title="..." metadata on every
  advertised rel (webmcp, api-catalog, agent-skills, describedby).
  describedby title matches specification.website verbatim.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: basgr

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "cf-webmcp",
-  "version": "0.3.2",
+  "version": "0.3.8",
   "description": "WebMCP at the edge: a Cloudflare Worker that equips any website with WebMCP from a single TOML config.",
   "license": "MIT",
   "private": false,