Fix self-scan, provenance export, and release surface alignment

[msaad00]

Summary

• fix the real self-scan CLI path so self-scan preserves agent-bom dependency inventory instead of collapsing to MCP registry fallback
• fail the release workflow loudly when provenance bundles are missing and export attestation files correctly for release assets
• align README, PyPI, Docker, Action, site docs, and MCP listing copy around one accurate CI/CD-capable agent-bom story

Validation

• python -m pytest -q tests/test_self_scan.py
• python scripts/check_release_consistency.py
• manual self-scan CLI check confirmed 39 self-scan packages end to end
• verified pipeline SVG drift removed for native OCI parser and 14 frameworks

Notes

• leaves local demo/report artifacts unstaged
• keeps scope to release truthfulness, provenance, and self-scan correctness only