feat(mcp): add dual-era 2026-07-28 transport support

[Schreezer]

Summary

• add automatic MCP 2026-07-28 negotiation to the MCP client while retaining legacy 2025-era compatibility
• add a strict modern stateless server adapter for execute and skills
• route modern traffic through self-host, local HTTP, Cloud, and the standalone Cloudflare host without applying legacy session-id rules
• preserve live multi-round execution state in the Cloudflare Durable Object while carrying only signed continuation state on the client

Implementation

• keep @modelcontextprotocol/sdk v1 for the existing legacy server and MCP Apps surface
• add exact v2 client, core, and server packages only at the migration seams
• authenticate and validate Host/Origin before protocol-era classification
• use createMcpHandler(..., { legacy: "reject" }) for the modern path
• bind signed request state to account, organization, resource, method, tool, code digest, and execution id
• deduplicate concurrent resume calls, cache terminal results for idempotent retries, and reject cross-principal replay
• negotiate modern HTTP/SSE/stdio clients automatically and retain era-aware legacy session recovery behavior
• add MCP_2026_07_28_ENABLED=false as an inbound-only rollback switch

Verification

• bun run lint
• bun run format:check
• @executor-js/host-mcp: typecheck and 192 tests
• @executor-js/plugin-mcp: typecheck and 128 tests, 29 skipped live-server cases
• @executor-js/cloudflare: typecheck and 63 tests
• self-host MCP: typecheck and 5 tests
• local MCP: typecheck and browser-resume regression test
• standalone Cloudflare host: typecheck and 12 real workerd tests, including modern stateless execution and a durable input_required approval round trip

The workspace-wide typecheck is currently blocked in the untouched @executor-js/integrations-registry package by missing Node type declarations. The workspace-wide test run reached 30 successful packages before the MCP Apps browser suite failed because /usr/bin/google-chrome is unavailable in the environment.

Current draft boundary

• modern inbound clients currently receive the core execute and skills surface
• artifact tools and MCP Apps remain on the proven legacy server path pending a v2 extension migration
• the local inbound stdio server remains legacy; outbound stdio clients negotiate both eras
• existing OAuth behavior is preserved, but this PR does not claim a complete OAuth-spec audit for the 2026 revision

References

• https://ts.sdk.modelcontextprotocol.io/v2/protocol-versions
• https://ts.sdk.modelcontextprotocol.io/v2/migration/upgrade-to-v2
• https://ts.sdk.modelcontextprotocol.io/v2/migration/support-2026-07-28