MCP Inspector's release process is a checked-in agent skill.

PR #2379 bumps to 2.7.0 with a full npm audit table across five lockfiles showing zero findings at every severity, not just at the --audit-level=high gate. The PR explicitly records that npm audit fix was not run, with or without --force, and that no git tag was created because the tag must point at the merge commit on main. The whole sequence is driven by a checked-in .claude/skills/release/SKILL.md, which is the cleanest example I've seen of a project encoding its release process as a skill rather than a wiki page.