feat: add SHD widget suite

RELEASE.md

@@ -35,7 +35,7 @@ catalog is a checked-in name snapshot, so a Skill cannot silently reference an
 unpublished MCP tool. Refresh it from the backend catalog before publishing.
 
 `scripts/mcp-runtime-smoke.mjs` checks OAuth metadata, authenticated MCP
-negotiation and the active-projects/Documents/Tasks/Finance/CRM resources.
+negotiation and all thirty-six widget resources.
 `scripts/mcp-oauth-e2e.mjs` is an opt-in Playwright check for the complete
 authorization-code + PKCE exchange using an already authenticated storage
 state. Neither script stores credentials or belongs in the static CI job.
@@ -52,9 +52,9 @@ JWKS signature and rejects a repeated `jti`.
    used by `SHD_MCP_WIDGET_ROOT`, or at the repository path documented by the
    backend loader.
 3. Run the backend MCP verification and a real authenticated OAuth/tool call.
-4. Reconnect the custom ChatGPT app and test active projects, Documents, Tasks,
-   Finance and CRM, including the plain structured fallback and each widget’s
-   refresh/detail action.
+4. Reconnect the custom ChatGPT app and test all thirty-six widgets, including
+   the plain structured fallback and each widget’s refresh/detail action where
+   supported.
 5. Record the exact revision and any runtime/browser checks. Static tests do
    not prove OAuth, ACLs, production hosting or ChatGPT rendering.