v0.3: migrate MCP transport to the 2026-07-28 stateless spec

[DhairyaShah981]

The MCP 2026-07-28 release candidate is out: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/

Material breaking changes:

• The protocol-level session is removed; Mcp-Session-Id header is gone.
• The MCP-Protocol-Version header is required on every HTTP request after handshake; servers MUST 400 on unknown versions.
• Error code for missing resource changed from custom -32002 to standard JSON-RPC -32602.

Tasks:

1. Bump the mcp SDK pin to the version that ships 2026-07-28 support.
2. Verify our trace_id-based audit correlation does not depend on the removed session id.
3. Wire the MCP-Protocol-Version header into the SSE transport server response.
4. Update tests/test_mcp_stdio_integration.py to use the new protocol version string.

Final spec lands 2026-07-28.

[DhairyaShah981]

Deferring to v0.3 roadmap — tracked in TODO.md. The current v0.2.x line is feature-complete for the live demo (SSE transport, in-memory PHI vault, MIT-level eval suite). Reopening when the v0.3 milestone work begins.