chore: release core 0.7.48, server 0.8.60, cli 0.10.52 and mcp 0.1.12

[vivek7405]

Clears the four packages carrying unreleased work since the 0.7.47 batch.

package	from	to	why
@webjsdev/core	0.7.47	0.7.48	3 feat, 2 fix
@webjsdev/server	0.8.59	0.8.60	3 feat
@webjsdev/cli	0.10.51	0.10.52	2 feat
@webjsdev/mcp	0.1.11	0.1.12	1 feat

Not bumped, deliberately. @webjsdev/ui, @webjsdev/intellisense and the
two editor packages picked up nothing user-facing in the range. The only ui
change was a corrected doc block in src/registry/fetcher.js plus its test,
landed under a chore: subject, so a bump would ship an empty changelog and
the backfill would refuse to write one.

What ships

A bound submitter carries its own submission (#1317). A
formaction=${action} button gains its own formmethod="post" plus
formenctype rather than relying on the enclosing form's start tag, so it
works inside a bound form, an unbound form, a method="get" form, or no form
at all. That deletes the silent-GET failure the previous release could only
report, and it reverses the part of #1207 that refused a plain button's own
formmethod, since the client router already honoured it with native
precedence. The client router also sends the enctype the author declared: a
plain <form method="post"> used to send urlencoded with JS off and multipart
with JS on, one template making two different requests.

The elision verdict is inspectable per app (#1312). webjs elision prints
the per-module verdict with the evidence behind every ship, --json emits it
for a tool, and --verify boots two handlers with WEBJS_ELIDE flipped and
diffs the masked SSR bytes across the app's own static route corpus, exiting
non-zero on a divergence and on a corpus where nothing was compared. The same
report reaches webjs doctor as a component check and MCP as list_elision.
The orphan scan's false positives are fixed in both packages.

SSR action seeding is observable in dev (#1311). X-Webjs-Seed plus a
seed field in the access log, and a browser warning that names only causes it
can prove. Seed ingestion flips to last-write-wins, with the drain-and-evict
work that makes it safe across a soft navigation and a <webjs-frame> swap.

Fixes. Back-button restore survives late layout growth (#1313), and
removeBetween no longer leaks one orphan comment node per teardown (#1292).

Publish ordering

changelog/core/0.7.48.md carries the earliest date: of the batch, so the
publish loop ships core first.

packages/server's declared @webjsdev/core range goes from ^0.7.47 to
^0.7.48. No new core export is imported statically, so this is not the
load-time skew the rule was written for. Both features span the two packages
over a shared wire contract though (the seed header and data-webjs-dev marker
core's client reads, the submitter attributes SSR emits and core's renderer
commits), and the release PR is the only place that bump is legal.

Notes curation

The generated entries were rewritten before committing: each package's entry
describes its own slice rather than repeating the shared commit subject, the
seeding feature's fourteen follow-up fixes are folded into the feature they
hardened, and the cli entry is narrowed to what actually changed in the
scaffold (a guidance comment, not the action).