[Agent composition] Document manifests, proposals, MCP v3, and migration

[paul-phan]

Parent RFC

• [RFC] Agent-ready Weaverse composition: manifests, proposals, approval, and rollback weaverse#493

Depends on

• Released SDK manifest support.
• Released Builder composition/proposal workflow.
• Released @weaverse/mcp v3.

Objective

Document the agent-ready composition architecture, security model, public contracts, and MCP v3 migration after the underlying behavior is released.

Scope

• Document generated component manifests, sensitivity metadata, repository guidance, and CI freshness checks.
• Document canonical composition reads, revision/hash semantics, redaction, and project allowlists.
• Document proposal operations, immutable revisions, stale-base behavior, preview, merchant approval, publication, audit, and rollback.
• Document the MCP v3 default proposal mode and explicitly enabled advanced live mode.
• Provide a 2.x-to-3.x migration guide, including renamed live tools and environment configuration.
• Clearly state that agents cannot approve or publish.
• Update examples and troubleshooting guidance.
• Coordinate matching updates to the canonical Weaverse Hydrogen skills and .cursorrules after SDK and Builder releases.

Acceptance criteria

• Documentation matches released package/API behavior rather than planned behavior.
• Security boundaries and token types are explicit.
• Proposal and advanced live examples cannot be confused.
• Migration guidance covers every renamed or removed MCP tool.
• Preview, stale-base rebase, destructive deletion warning, publication, and rollback have end-to-end examples.
• Canonical Hydrogen skills are updated and verified against the released versions.
• Documentation links back to the umbrella RFC and implementation issues.

Out of scope

• Shopify Standard Actions/Events and WebMCP, tracked under Weaverse/builder#2657.