chore: add release-it config

Standardizes the tag and commit message format on the v-prefixed
convention shared with mcp-appstore-connect.

Both publishing steps are left to CI: npm.publish is false because the
publish-npm job handles it with OIDC trusted publishing and provenance,
and github.release is false because the github-release job already
creates the release from the tag — having release-it do it too would
race that job for the same release.