fix: 修复 MCP 证书绑定、取消清理与任务生命周期

.github/workflows/cli-release.yml

@@ -162,59 +162,7 @@ jobs:
           cp tools/licenses/XopProtector-LICENSE.txt bundle/licenses/
           cp tools/licenses/XopProtector-NOTICE.txt bundle/licenses/
 
-          cat > bundle/README.md <<EOF
-          # Shellsmith CLI + MCP ${VERSION}
-
-          Platform: ${PLATFORM}
-
-          This bundle contains the `shield` CLI and the `shellsmith-mcp` stdio server.
-          No artifact, certificate or password is uploaded by this package.
-
-          ## Verify
-
-          \`\`\`bash
-          ./bin/shield --version
-          ./bin/shellsmith-mcp --version
-          \`\`\`
-
-          ## MCP client configuration
-
-          Use an absolute path to the extracted bundle:
-
-          \`\`\`json
-          {
-            "mcpServers": {
-              "shellsmith": {
-                "command": "/absolute/path/to/bin/shellsmith-mcp",
-                "args": ["--allow-root", "/absolute/path/to/projects"]
-              }
-            }
-          }
-          \`\`\`
-
-          `shellsmith-mcp` automatically finds the sibling `shield` binary. If you keep
-          the CLI elsewhere, pass `--cli /path/to/shield` or set
-          `SHELLSMITH_MCP_CLI=/path/to/shield`.
-
-          Keystore passwords are read from the MCP server environment only:
-
-          \`\`\`bash
-          export MOCIKA_SHIELD_KS_PASS="..."
-          export MOCIKA_SHIELD_KEY_PASS="..."
-          \`\`\`
-
-          Do not put a plaintext password in the MCP client JSON or tool arguments.
-
-          ## Requirements
-
-          - Java 17+ with \`java\` and \`keytool\` available.
-          - AAB workflows also need \`bundletool.jar\` and \`aapt2\`; pass their paths to the tool.
-          - Android APK/AAB work stays on this machine; iOS archive requires macOS and Xcode.
-          - macOS: if Gatekeeper blocks the unsigned CLI, run
-            \`xattr -rd com.apple.quarantine /path/to/Shellsmith-cli-*\`.
-
-          See \`docs/mcp.md\` in the repository for the full tool list and security model.
-          EOF
+          bash scripts/render-mcp-release-readme.sh bundle/README.md "$VERSION" "$PLATFORM"
 
       - name: Archive and checksum
         shell: bash