fix: preserve version brand provenance

[FreeOnePlus]

Summary

• keep brandless FE and BE versions unknown when the cluster version comment does not establish a recognized brand
• reject version comments whose leading brand and embedded version-prefix brand do not match
• validate Apache Doris and downstream certification evidence with an exact, registry-independent brand/version matcher
• add regression coverage for every provenance boundary and record the fix in the changelog

Root cause

The distribution-brand compatibility work preserved numeric version gates, but two fallback paths could still erase provenance. An unknown cluster brand could default bare component versions to Apache Doris, and the version parser independently accepted the leading and embedded brand tokens. Apache certification evidence also reused the mutable runtime parser without requiring the parsed brand to remain Apache Doris.

Validation

• 178 passed in the focused version, feature-matrix, detector, and multi-worker configuration suite
• 1863 passed, 85 skipped in the complete test suite
• total coverage: 68.12% (required: 55%)
• ruff check .
• mypy doris_mcp_server
• bandit with the repository CI configuration
• lock-file and generated tool-catalog checks
• source distribution and doris_mcp_server-1.0.0 clean-wheel smoke test