[jlitola]

Prepare githits 0.33.0 and @githits/mcp 0.33.0 from the complete delta since v0.32.0 / mcp-v0.32.0.

Both artifacts warrant a minor bump: Launchpad Git targets/shortcuts and registry repository provenance add public functionality. Grep coverage/recovery wording is patch-level. The direction is sound: ship the merged features together and keep the coordinated package minors aligned.

• Include Accept owner-qualified Launchpad Git targets in CLI and MCP #494, fix: explain incomplete grep results and name retry targets #496, feat: accept Launchpad Git shortcuts #498 and the newly merged feat: show registry repositories in package info #497.
• Consolidate all four fragments into separate package changelog sections; preserve historical sections unchanged.
• Align package, lockfile, MCP registry and generated plugin versions.
• Complete the deferred Launchpad CLI skill/reference update and document package registry provenance in the package skill/reference.
• Production schema availability for feat: show registry repositories in package info #497 is verified through the rebuilt CLI and local MCP; hosted MCP still requires package adoption and deployment in remote-mcp.

Validation:

• bun test: 6,480 passed, 0 failed.
• Root/MCP builds, typecheck, formatting, generated-plugin checks and public-package validation including MCP publication dry-run passed.
• Source CLI/MCP smoke passed with GITHITS_AUTH_STORAGE=file; live cohorts correctly skipped with AUTH_REQUIRED. Default isolated-home runs hit macOS Keychain errors; normal host authentication worked for the production checks.
• Built CLI/MCP secret-free smoke passed.
• 24 authenticated production CLI/MCP checks passed for Google Maven, Maven Central, absent npm provenance, and pinned dependency/vulnerability identities.
• Targeted production Launchpad CLI skill eval completed in 84 seconds with 12 CLI calls and five canonical source reads; final answer included both exact commits, lines and canonical owners with reported high confidence. No isolation-violation artifact was emitted. This is observed tool use, not independently graded answer quality.

Known production finding: five eval calls failed with repository-provider timeouts while acquiring Launchpad shortcut owners. A subsequent bounded four-case comparison passed both short and canonical list inputs (1.5 seconds for each shortcut, 1.2 seconds for each canonical target). The intermittent backend cause remains unverified and is recorded with timestamps in docs/backlog.md; no client retry mechanism was added.

Pending PR assessment: #487 remains excluded because backend qualification/work is incomplete and the branch conflicts with main. No other open CLI PR warrants holding this release; remaining items are older onboarding, documentation, security-scanning or dependency changes, with conflicts/failing checks among dependency PRs.

Preparation only. No merge, auto-merge, tag, publication or deployment is authorized by this PR.