fix(mcp-proxy): tighten public trust and approval env hygiene

[oleg-bk]

Summary

This PR closes the public adoption and trust hygiene batch for AgentVeil MCP Proxy:

• updates the root README PyPI badge/link to 0.7.28
• qualifies empty and chain-only evidence verification so empty bundles no longer show bare VERIFY: passed
• improves CLI onboarding help and keeps init next-step guidance privacy bounded
• adds a bounded agentveil-mcp-proxy demo flow that shows the generic redirect -> approval -> local proof loop without exposing policy/playbook depth
• minimizes managed Approval Center child process environments across shared, launcher, and legacy Claude lifecycle paths

Why

The fixes address concrete public trust issues:

• version/readme drift makes the package look stale
• empty evidence verification could overclaim proof
• flat CLI help hid the golden path
• new users lacked a quick way to see the routed approval loop
• managed Approval Center processes inherited full parent environments, including possible provider/cloud secrets

Validation

• Focused tests for each slice passed locally.
• Full local public SDK PR gate passed on HEAD=787c0a73580c4e28c59aa6e7abf8013d618af3b7:
  • 1566 passed, 1 skipped, 2 warnings
  • public_sdk_pr_gate: ok

Notes

• The demo uses a single generic inline redirect and does not enumerate redirect playbooks, risk taxonomy, or private policy depth.
• The PR does not perform a release. A patch release should be handled separately after merge and release gates.

Implemented with assistance from Codex.