v1.18.1

## v1.18.1

A small patch for two broken paths:

- **Bundled MCP server starts again.** The root npm package now includes the `mcp/package.json` that its `camofox-browser-mcp` command reads at startup. Fixes [#12323](https://github.com/jo-inc/camofox-browser/issues/12323). The standalone MCP package is also published at 1.18.1.
- **Container VNC without a surprise exposed port.** `VNC_BIND` still controls noVNC only. Native VNC stays on loopback unless you explicitly set `VNC_RFB_BIND`; a non-loopback native bind requires `VNC_PASSWORD`. Container setup and the passwordless noVNC warning are documented. Fixes [#12372](https://github.com/jo-inc/camofox-browser/issues/12372) via [#12468](https://github.com/jo-inc/camofox-browser/pull/12468). Thanks to [@mmbeanz](https://github.com/mmbeanz) for the reproduction and investigation in [#12374](https://github.com/jo-inc/camofox-browser/pull/12374).

The bundled npm browser download is pinned to Camoufox `152.0.4-beta.30`: a newer upstream binary introduced a startup incompatibility with the pinned `camoufox-js`. Both the automatic install and `npm run fetch-bin` now select the tested release. Root and standalone MCP dependency pins include the patched `hono` version.

The root package was packed and installed into a clean directory, and its MCP handshake passed. Linux and Windows browser E2E, unit tests, the ClawHub dry run, and post-merge CI passed. The VNC behavior was also tested in a live ARM64 container.

This release does not include the separate native-credential prototype.