fix(ci): add v3/@claude-flow/mcp to the root npm workspaces so npm ci resolves the unpublished alpha.10 pin (#3203)

Root package.json and v3/@claude-flow/cli/package.json pin
@claude-flow/mcp@3.0.0-alpha.10 (since 16b0dc4d5, release 3.38.17), but
the registry only has 3.0.0-alpha.1/7/8/9, and v3/@claude-flow/mcp was
the one bundled package not listed in the root workspaces (codex,
plugin-agent-federation and security are). Root `npm ci` therefore hit
the registry and failed with ETARGET on main and on every PR since
2026-08-22, before any test ran.

Listing the package as a workspace member makes npm resolve it locally
(lockfile entry: `"node_modules/@claude-flow/mcp": {"resolved":
"v3/@claude-flow/mcp", "link": true}`), matching how the other three
bundled packages already resolve. No version change; the pin stays
alpha.10 and the tarballs still bundle it.

Found by the 2026-09-05 PR-review mission (agent pr-review-ruflo):
verified in main's own Test Suite job and in 3 red jobs on #3177.


Claude-Session: https://claude.ai/code/session_019xHM4rAH4aaShb4DTr1n6s

package.json

@@ -3,6 +3,7 @@
   "version": "3.38.21",
   "workspaces": [
     "v3/@claude-flow/codex",
+    "v3/@claude-flow/mcp",
     "v3/@claude-flow/plugin-agent-federation",
     "v3/@claude-flow/security"
   ],