fix: remove .mcp.json to stop shadowing user-scope skillsmp (v1.4.2)

[girofu]

Summary

• Fix: remove repo-root `.mcp.json`. It registered a project-scope `skillsmp` MCP server with no `SKILLSMP_API_KEY`. Because the entire repo is the plugin payload (`marketplace.json` → `source: "./"`), every v1.4.1 plugin user's properly-configured user-scope `skillsmp` (where the key lives) was silently overridden, causing SkillsMP semantic + keyword search (Sources 1–2) to fail without any visible error.
• Release: bump `.claude-plugin/plugin.json` to `1.4.2` and finalize CHANGELOG. Cut annotated tag `v1.4.2` + GitHub Release after merge.

Why now

v1.4.1 was released 2026-04-23 04:51Z. Plugin-installed users currently see broken SkillsMP tools (they appear as MCP tools but calls fail). Fix is strictly subtractive — deleting one 88-byte invalid config file — and unblocks the intended semantic-search path.

Blast radius by install path

Path	Before fix	After fix
`claude plugin install`	Broken — keyless .mcp.json shadows user-scope skillsmp	`claude plugin update` does `git pull`, removes the file; user-scope version (with key) becomes active
`npx skills add`	Unaffected (whitelist: `skills/skill-fetch/*` only)	Unaffected
`curl install.sh | bash`	Unaffected (hardcoded `FILES[]`)	Unaffected
`install.py`	Unaffected (hardcoded `FILES`)	Unaffected

Only the plugin path is affected, and `git pull`-based plugin updates propagate file deletions correctly, so existing v1.4.1 plugin users auto-heal on next `claude plugin update`.

Migration

Users who want SkillsMP semantic search must register the server once at user scope:
```bash
claude mcp add --scope user skillsmp -- npx -y skillsmp-mcp-server --env SKILLSMP_API_KEY=your_key
```
Or interactively via `/fetch-skill-config` (already documented in README §SkillsMP).

Test plan

• Verify `install.sh` / `install.py` `FILES[]` whitelist does not reference `.mcp.json` (grep-confirmed)
• Verify `marketplace.json` `source: "./"` means plugin payload = entire repo (read manifest)
• Fresh clone of main confirms `.mcp.json` exists on origin pre-merge (88 bytes) and disappears on this branch
• Post-merge: cut `v1.4.2` tag + GitHub Release
• Post-release: verify `claude plugin update skill-fetch` on a test machine removes the stale `.mcp.json`

🤖 Generated with Claude Code