Catch nested server.json publish PRs and clarify publishing guidance

[rdimitrov]

Invalid publishing attempts such as #1698 add server.json under a namespace path (io.quickbrew/mcp-server/server.json), which the existing auto-close workflow misses. Match **/server.json in both detection and closure so these paths are handled consistently, and update the closure message to explain the broader coverage.

Clarify in README.md and CLAUDE.md that adding server files anywhere in this repository does not publish a server, even if a PR is merged. Direct publishers to mcp-publisher in their own project.

Add AGENTS.md as a symlink to CLAUDE.md so agents using either filename read the same guidance without duplicating it.

Update the pinned golangci-lint from v2.13.1 to v2.14.0 after CI using Go 1.27.2 failed to decode Go export data with the old linter. Lint, validation, and build passed with the updated linter. The subsequent vulnerability scan reported five findings in golang.org/x/net v0.59.0, so update it to the reported fixed version, v0.60.0, and refresh module checksums.

The existing trusted-contributor exemption and requirement that every changed file match remain in place. The broader rule intentionally also covers PRs consisting only of server.json fixtures or examples from untrusted contributors; these can require maintainer intervention.

Validation: 12 behavioral cases passed for each matcher, including the path from #1698, nested paths, root paths, mixed code/documentation changes, and non-matching filenames. Confirmed both matchers agree, both workflows parse as YAML, all embedded Bash scripts pass bash -n, and git diff --check passes.