chore(glama): container image for the MCP server + maintainer claim

Directory listings (Glama, and awesome-mcp-servers via its bot) refuse to list a
server they cannot build and start. Both files exist for that gate:

- mcp-server/Dockerfile packages ONLY mcp-server/, not the RCLL backend. The
  five tools register at module load, before any HTTP call, so introspection
  succeeds with no backend reachable — verified by building the image and
  running an initialize + tools/list handshake over stdio (5 tools, stdout clean
  of anything but protocol frames; the startup banner goes to stderr).
- glama.json names geratron as maintainer, which is how Glama grants the claim
  needed to attach the Dockerfile on their side.

Not a deployment artifact: no image is pushed to any registry, and the compose
stack at the repo root is still the way to run the backend.

.github/dependabot.yml

@@ -1,6 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"

FORK.md

@@ -122,3 +122,24 @@ upstream  https://github.com/vectorize-io/hindsight.git   (push URL deliberately
 and this repository is one decision away from being made public with an already
 published `server.json` — a rewritten history is a one-way door. The series
 lives on its own branch; repointing `main` is the owner's call.
+
+## Dependency updates: why there is no dependabot
+
+`.github/dependabot.yml` was removed on 2026-08-28. It was not failing — it was
+running in a loop that could never land.
+
+GitHub is a **push mirror** of the Forgejo canon, not a peer. The mirror sync
+force-matches refs, so a branch dependabot opens on GitHub is deleted within the
+hour and its pull request closes itself. Two runs proved it (`bump
+actions/checkout 4 → 7` and `bump actions/setup-node 4 → 7`, both opened
+2026-08-24, both auto-closed). A public repository whose only pull requests are
+self-closed bot PRs reads as abandoned, which is the opposite of what the bot is
+for.
+
+The bot's one useful output was taken by hand: `.github/workflows/publish.yml`
+now pins `actions/checkout@v7` and `actions/setup-node@v7`, and that upgrade
+shipped in the 0.1.0 release.
+
+Action versions are therefore bumped on the canon, by hand, when the workflow is
+touched. If GitHub ever becomes the canon rather than a mirror, restore the file
+— the loop closes only because pushes are one-way.

glama.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://glama.ai/mcp/schemas/server.json",
+  "maintainers": [
+    "geratron"
+  ]
+}

mcp-server/Dockerfile

@@ -0,0 +1,31 @@
+# Container image for the fleet-memory MCP server (stdio transport).
+#
+# This image exists for directory listings (Glama and friends) that require a
+# buildable Dockerfile and start the server to introspect its tool list. It
+# packages ONLY mcp-server/, not the RCLL backend: the MCP server is a thin
+# stdio client that talks to a self-hosted backend over FLEET_URL.
+#
+# Introspection works with no backend reachable — the five tools are registered
+# at module load, before any HTTP call. Actual tool calls need FLEET_URL to
+# point at a running RCLL API (see docker-compose.rcll.yml at the repo root).
+#
+#   build:  docker build -t fleet-memory-mcp mcp-server/
+#   run:    docker run --rm -i -e FLEET_URL=http://host.docker.internal:5100 fleet-memory-mcp
+
+FROM node:22-alpine
+
+WORKDIR /app
+
+# Dependencies first so the layer caches independently of server.js edits.
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev
+
+COPY server.js README.md LICENSE ./
+
+# Backend location. Overridden at run time; the default matches the local
+# docker-compose stack. The pre-rebrand name HINDSIGHT_URL is still read.
+ENV FLEET_URL=http://127.0.0.1:5100
+
+# stdio transport: the container talks MCP over stdin/stdout, so it must be run
+# with -i and must not print anything but protocol frames on stdout.
+ENTRYPOINT ["node", "server.js"]