feat(mcp): migrate to split SDK v2

[ElbertePlinio]

What changed

• migrate the stdio edge from SDK v1 to stable split MCP SDK v2 packages
• serve legacy 2024/2025 and modern 2026-07-28 eras from one explicit server factory
• preserve legacy elicitation while giving modern clients honest relay-and-retry guidance
• harden EOF, transport self-close, error, and close-once lifecycle behavior
• add raw-wire protocol revision tests and clearly labeled Claude Code, Codex, and Pi contract approximations
• remove the obsolete Express/Hono dependency overrides and stale Hono OSV suppression

This is PR 5 of issue #64's six-PR stack. It is a sibling of PR 4 and is based on PR #69 (feat/64-flutter-pack); PR 6 will integrate both slices.

Validation

• frozen Bun install, typecheck, lint, and build
• focused MCP/server/CLI suite — 119 passed, 2 expected headed-test skips
• five supported legacy revisions, unsupported-version counter-offer, modern discovery/envelope, Tasks absence, stdout purity, and real transport self-close wire coverage
• OSV Scanner v2.3.8 — no unfiltered advisories
• serious-backend local review plus independent final Opus verification — clean at reviewed HEAD a26535e

Not tested / limits

• Raw-wire harness cases are representative contract approximations; proprietary Claude Code, Codex, and Pi binaries were not run.
• The local full suite reached 1,097 passing tests with 44 skips; eight existing desktop tests could not start Xvfb locally. CI installs the headed dependencies and is authoritative.
• Tasks, MRTR/input-required, sampling, HTTP, auth, and new product behavior remain out of scope.

Risk class: serious backend / protocol and process lifecycle.

Refs #64

[ElbertePlinio]

Ready for human review

Reviewed HEAD: 54a195418e715360812e76fe07129fcb1589f72e
Base: feat/64-flutter-pack

All required CI is green in run 32086544702:

• dependency audit
• Gitleaks history scan
• Ubuntu Rust fmt, Clippy, and tests
• Windows-native Rust fmt, Clippy, and tests
• headed Bun tests, coverage, and build

The split SDK v2 migration and dual-era stdio contracts completed independent review with no unresolved P0–P2 findings.

Status: Ready for human review. No merge or release performed.