Fix GraphQL toolkit audit findings

[mstuart]

Summary

• centralize GraphQL TypeRef to Zod conversion so NON_NULL rejects omission/null while nullable args accept nullish values across MCP, LangChain structured tools, and Vercel AI tools
• avoid persisting literal init header secrets by writing env placeholders, expand those placeholders when serving from config, and document env-based MCP onboarding
• align Node support to 22 across docs/build target, make release checks match CI with strict npm ci, add coverage scripts/gate, runnable examples, and higher-intent npm keywords

Validation

• vexp run_pipeline attempted first but daemon socket was unavailable: /Users/mark/git/cull/.vexp/daemon.sock
• git history inspected: main at 2150878, avoided unrelated dependency PR branches
• npm ci
• npm run lint
• npm run typecheck
• npm test: 16 files, 153 tests passed
• npm run test:coverage:check: all thresholds passed, overall lines 85.13%, statements 83.45%, branches 71.28%, functions 89.6%
• npm run build
• npm pack --dry-run
• npm audit --audit-level=high: found 0 vulnerabilities