docs(mcp): refresh remote-MCP submission runbook (#148)

Re-verified against official docs 2026-07-13. CIMD is now the primary
auth on both platforms (DCR fallback); OpenAI 'app' directory became the
'plugin' directory (2026-07-09); 1.10.0 closed the openWorldHint/
instructions/sessionFingerprint items. Adds the missing migration-
application procedure (managed-pair deploys don't auto-migrate; DCR/CIMD
500 until 016_oauth_server is applied) and a status-at-a-glance table
reflecting the live-verified discovery/auth surface.

Co-authored-by: Contentrain <mcp@contentrain.io>

Author: ABB65