Ban 'latest' as a reserved version string - #413

<!-- Provide a brief summary of your changes -->

Validates that server versions are not ranges.


**NB:** This also introduces `validateVersion` as a check on the
top-level `ValidateServerJSON`, as previously we were only checking
version ranges of packages via `validatePackageField` (i.e. `latest`
would have still been a valid top level server version), despite #413's
wording suggesting otherwise.

## Motivation and Context
Solves #415

## How Has This Been Tested?

Tests added in `internal/validators/validators_test.go`

`make check` is clean.

## Breaking Changes
As per @domdomegg's comment, we should
> check nobody has done this in the existing registry data (if they
have, we should explore and understand why people have done this / if
it's valid etc.).

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

…rguments (#1583)

## Summary

Publish accepts arguments that violate the schema. `validateArgument`
only checks the named branch, so a `type` that is empty or outside the
enum passes through, and a positional argument with neither `value` nor
`valueHint` also passes. The scan in #1546 counted 52 entries with bad
argument types and 8 bare positional ones, my own paging of /v0/servers
found even more of the first kind. One I checked by hand:
`io.github.Jordan-Horner/[email protected]` (empty type under
packageArguments), another is `com.keyboardcrumbs/[email protected]` (type
"literal", still active). Every published schema version requires `type`
to be "positional" or "named" and positional args to carry `value` or
`valueHint`. Relates to #1546, the empty repository case is #1555's, and
version "latest" is already handled since #413.

## Change

`validateArgument` becomes a switch. Named branch unchanged. Positional
now requires `value` or `valueHint`. Unknown or empty `type` is
rejected. Two new errors in constants.go, references
`invalid-argument-type` and
`positional-argument-value-or-hint-required`.

Why not full schema validation at publish: the enhanced validation
design doc gates that behind the anyOf error consolidation (Phase 3),
raw anyOf failures on arguments come out as a noisy multi-error cluster.
These two checks give one clean message each and are one case arm each,
easy to delete at Phase 5 when schema-first lands. Until then publish
and edit just agree with what /v0/validate already reports.

Heads up on two consequences: editing a stored server that still carries
one of these legacy arguments will 422 until the argument is fixed, and
the importer skips invalid servers with a warning, so a re-seed from a
live dump drops those entries instead of failing. Also #1339 adds a
check inside the named branch of the same function, whichever lands
second has a small conflict to resolve there, happy to do it from my
side.

## Test

Tests first, they fail on main, the handler regression actually
publishes an empty-type argument with 200 on main and gets 422 with the
fix. On the branch: go test ./internal/... all green including the
handler tests against postgres, golangci-lint v2.13.1 (what CI pins) 0
issues, make validate passes. Two existing fixtures had positional args
with neither value nor valueHint, they got a valueHint since no
published schema version ever allowed that shape. New error paths and
references are pinned in validation_detailed_test.go.

## AI Disclosure

AI assistance (Claude) was used for issue research and during
development. All changes were reviewed and tested by the author.

---------

Co-authored-by: Radoslav Dimitrov <[email protected]>