chore: release githits and MCP 0.28.0

[jlitola]

Prepare coordinated githits and @githits/mcp 0.28.0 releases from the full delta since 0.27.1. The indexing wait changes are breaking and ship as a pre-1.0 minor release.

• Search and search-status --wait values now use integer milliseconds: migrate --wait 30 / --wait 30s to --wait 30000. Seconds suffixes are rejected.
• Omitted indexing preparation waits use 30000 ms, including direct searchStatus; explicit zero and non-waiting grep continuation remain supported.
• Consolidate all eight pending fragments into separate package changelog sections, retaining dependency security updates, workflow permissions, the portable scorer, and shared upgrade guidance. Historical entries are unchanged.
• Align package, lockfile, registry, and generated plugin versions; update CLI skills for the released wait behavior and local upgrade checks. Hosted MCP adoption and deployment remain separate.

Validation:

• bun test: 5,663 passed; release-boundary and skill-packaging tests also passed after the final documentation edits.
• Build, type check, plugin generation/check, and public-package validation passed.
• Authenticated bun run smoke:cli passed, including CLI/MCP JSON parity. Every stable authenticated MCP smoke case passed.
• Built CLI unauthenticated and MCP registration smoke suites passed under Node.
• Targeted Codex skills evals: search-source-ergonomics (7 GitHits calls) and package-upgrade-safety (11 calls), both executed successfully, loaded the updated skills, and reported no isolation violations or metrics warnings. These are execution checks, not a quality grade.
• Full live smoke:mcp ended at the experimental Research text follow-up. A narrow reproduction confirmed the backend rate limit on the third Research call; its first two calls succeeded. No retry or rate-limit behavior was changed.

This PR prepares the release only. Merge requires separate human approval; the normal Main-triggered publication workflows run after merge.