fix(mcp): support July 2026 while preserving legacy stdio - #1085

The previous SDK supports legacy initialization but does not implement July 2026 stateless discovery. Upgrade the existing mcp-go dependency from v0.54.1 to v1.3.0 and explicitly choose private, zero-TTL cache hints. Preserve all four legacy revisions and existing text/error semantics; add real-wire proof for the July model without introducing another server or transport.

Follows merged PR1084 and PR1083. GitHub automatically transitioned the base to main after the prerequisite merge. A normal main merge preserves the reviewed history; all 723 MCP/CLI/dependency entries match the prior reviewed source and all 34 incoming plugin files exactly match main. The diff remains the same 11 SDK/protocol/docs/plan files.

Validation:

• All-consumer API compilation, full local Go package suites (MCP/CLI plus all remaining171 packages), focused race checks, offline built-in schema audit, module tidy and repository-wide CI-version lint pass. Live Docker tests were explicitly disabled on the Mac.
• A clean CLI at 7943d6c passes four legacy revisions and stateless 2026-07-28: discovery, typed calls/errors, exact synthetic local documentation, explicit complete/private/zero metadata, ordering, version/capability isolation, clean framing and bounded shutdown.
• Cooperative cancellation uses the separate entered-handler engine double; the production CLI proves cancellation-notification robustness and recovery.
• Fresh exact-artifact rollback passes 7943d6c candidate → clean 40ef2b4/SDK0.54.1 (legacy pass; July discovery -32601) → candidate July/mixed pass. No published history, installed binary or session was reset.
• Independent task specification and quality reviews pass. Public-data and scope audits pass; only the existing SDK changes in the dependency graph.
• Verified CLI SHA256: 8be6554122c60a6738f82e77b2615b5e27b2775fe58a3d1f1cec39fdbcd0a6ad (vcs.modified=false). The six-task/two-PR plan is complete; the final MCP/CLI/dependency trees match the independently reviewed Task5 source. All four hosted cross-plugin and typed-E2E checks passed at the prior reviewed source. Fresh MCP tests, the root standalone plugin integration and the actual five-version CLI wire matrix pass at this integration commit. Full native CI passed at this exact main-based head: race/coverage Go suite, all required checks, lint, build, examples and policy. CodeQL security/quality and the PR OSV scan passed. All four cross-plugin/IaC checks also passed at this head. Independent integration spec and quality reviews pass with no findings.

The packaged maintainer smoke client intentionally accepts release-form versions only. An additional probe of this source pseudo-version returned bounded version_unknown before fixture calls; it was not bypassed or relabeled. The verified packaged release pairing remains v0.86.2.

These are source-build claims; v0.86.2 predates this change. Text-only results remain. Wire proof does not certify host/directory eligibility, real engine execution, HTTP/authentication, tasks/UI or Compute. General filesystem confinement, resource budgets, rate limits and redaction remain deferred. No installation or deployment is included.

The preexisting Sonic/Go1.27 benchmark-listing diagnostic is explicitly nonblocking under the owner's instruction. No benchmark, workflow-policy or protection override is included; no performance comparison is claimed.