fix(mcp): install 0.0.14-dev.6 so consent ships (WALM-685)

[ducnmm]

Ticket

WALM-685 — https://linear.app/mysten-labs/issue/WALM-685/reviewed-main-snapshot-is-missing-the-plugin-security-fixes-from-dev

What changed?

• mcpPackageVersion in packages/mcp/plugin/plugin.json is 0.0.14-dev.6, not 0.0.14-dev.2.
• The ## 0.0.14 changelog entries (package and docs) name that pin. dev.2 has no consent.js or memory-policy.js.

Why is this needed?

Marketplace installs from public dev. The pin 0.0.14-dev.2 ships an MCP server without the WALM-642 secret-exclusion and consent modules. 0.0.14-dev.6 has them. Package version stays 0.0.14 so the pin remains a prerelease of that release.

Scope

Point the plugin launcher at the published build that contains consent and memory policy.

Out of scope

0.0.14-rc.1 waits until #986 merges. This PR does not publish.

How was this tested?

• Unit tests
• Integration tests
• End-to-end tests
• Manual testing
• Not applicable

Commands: node scripts/verify-manual-sdk-release.mjs; node --test packages/mcp/test/trusted-launcher.test.mjs (29 pass).

How can the reviewer verify it?

1. packages/mcp/plugin/plugin.json mcpPackageVersion is 0.0.14-dev.6. version is still 0.0.14.
2. node scripts/verify-manual-sdk-release.mjs passes.

Risks and dependencies

New installs from dev will npm-install 0.0.14-dev.6 into ~/.memwal/runtime. Machines that already installed dev.2 keep that runtime until the version directory changes.

Author checklist

• This pull request maps to one ticket and one logical outcome.
• I reviewed the complete diff myself.
• I removed unrelated, debug, and temporary changes.
• I ran the relevant tests.
• CI is green.
• The branch is up to date with its target branch.
• I added or updated tests where appropriate.
• I documented any important risk, dependency, rollout, or follow-up.
• I provided clear verification steps.
• The pull request is ready for review and is no longer a Draft.

[HoangDucBach]

LGTM!

[ducnmm]

@harrymove-ctrl this is approved on f3bf6d5c. Please merge to dev. I will check after it lands.