fix: unblock client release workflows

[linfangw]

Summary

• Let the MCP OpenAPI generation script use a pinned npx invocation so package.json stays aligned with the existing lockfile for npm ci
• Allow explicit Python SDK QverisConfig constructor values to override environment aliases
• Add a regression test for constructor values taking precedence over QVERIS_* environment variables

Validation

• git diff --check
• npm --prefix packages/mcp ci
• npm --prefix packages/mcp run typecheck
• npm --prefix packages/mcp test
• npm --prefix packages/mcp run build
• env QVERIS_API_KEY=sk-env QVERIS_BASE_URL=https://env.example/api/v1 uv run --extra dev pytest tests/test_client_contracts.py -q
• env QVERIS_API_KEY=sk-env QVERIS_BASE_URL=https://env.example/api/v1 uv run --extra dev pytest
• env QVERIS_API_KEY=sk-env QVERIS_BASE_URL=https://env.example/api/v1 uv run python -m compileall qveris examples

Release Follow-up

After this merges, move tags mcp-v0.7.0 and python-sdk-v0.2.0 to the merge commit and force-push those tags to rerun the failed release workflows.

[gemini-code-assist]

Code Review

This pull request modifies the build scripts in packages/mcp/package.json by switching to npx for openapi-typescript and removing it from devDependencies. It also updates the Python SDK's QverisConfig to support population by name and adds a test verifying that constructor arguments take precedence over environment variables. Feedback was provided regarding the removal of the openapi-typescript dependency, recommending it be kept to ensure build determinism and avoid unnecessary network requests.