feat(deps): floor MCP SDK at ^1.27.1 (ADR-0016 step 3)

Captures WebStandardStreamableHTTPServerTransport.onerror fix
(modelcontextprotocol/typescript-sdk#1580, merged 2026-02-24) — without
the floor, the deployed function silently swallows transport-layer
errors before they reach the onerror callback.

Lock regen resolves to 1.29.0 (within range; latest stable). No
behavior change in the currently-deployed bundle — this widens the
contract declaration, doesn't tighten the runtime. Redeploy not
strictly required; recommended on next major bump for source-tree-
vs-deployed alignment per ADR-0015.

Recon: docs/recon/2026-05-02-v1.0.0-ship-surface-recon.md § Decision 5.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 0xquinto

bun.lock

@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.92.0",
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.27.1",
     "@supabase/supabase-js": "^2.88.0",
     "postgres": "^3.4.9",
     "zod": "^3.23.0"

package.json

@@ -1,9 +1,9 @@
 {
   "imports": {
     "supabase-realtime-skill/server": "npm:supabase-realtime-skill@^0.2.0/server",
-    "@modelcontextprotocol/sdk/server/index.js": "npm:@modelcontextprotocol/sdk@1.29.0/server/index.js",
-    "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js": "npm:@modelcontextprotocol/sdk@1.29.0/server/webStandardStreamableHttp.js",
-    "@modelcontextprotocol/sdk/types.js": "npm:@modelcontextprotocol/sdk@1.29.0/types.js",
+    "@modelcontextprotocol/sdk/server/index.js": "npm:@modelcontextprotocol/sdk@^1.27.1/server/index.js",
+    "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js": "npm:@modelcontextprotocol/sdk@^1.27.1/server/webStandardStreamableHttp.js",
+    "@modelcontextprotocol/sdk/types.js": "npm:@modelcontextprotocol/sdk@^1.27.1/types.js",
     "@supabase/supabase-js": "npm:@supabase/supabase-js@^2.105.1",
     "postgres": "npm:postgres@3.4.9",
     "zod": "npm:zod@3.25.76"