feat(mcp): align yarr with MCP 2026-07-28

[jmagar]

Stack context

This draft is intentionally stacked on ThomasDalla's #129. The inherited SEP-2549 commits remain at the bottom of this branch until #129 lands; after that, rebase this branch onto main so the inherited diff disappears. The h2 security lock refresh from #128 is also incorporated so Cargo Deny is meaningful on the stack.

Completed slices

• Tightened fix(mcp): emit SEP-2549 cache hints so HTTP clients accept list results #129 wording and added Flat-mode SEP-2549 wire coverage.
• Explicitly own the MCP protocol revisions Yarr advertises instead of inheriting future rmcp KNOWN_VERSIONS automatically.
• Added real server/discover protocol-contract coverage for 2026-07-28.
• Implemented native SEP-2322 MRTR destructive confirmation for 2026-07-28 direct tools/call.
• Added opaque 256-bit one-time requestState handles with TTL/capacity bounds, principal + exact-call binding, tamper rejection, and consume-before-dispatch replay prevention.
• Added side-effect-free Code Mode/snippet preflight: real reads may drive branches, mutations are inert during planning, and destructive target occurrences are collected before execution.
• Bound Code Mode confirmation to canonical destructive target occurrences, with counted occurrence budgets at runtime so one approved target cannot be repeated more times than confirmed.
• Preserved legacy peer elicitation for pre-2026-07-28 callers.
• Added modern/legacy resultType wire coverage for lists/reads, prompts/get, and tools/call.
• Updated README, CLAUDE.md, CHANGELOG, and the npm package README.
• Refreshed vulnerable/yanked transitive lock entries (h2 0.4.16, rustls 0.23.45, rand 0.10.2 / chacha20 0.10.1).

Verification

Final head d44dd1b is green for the tracked CI matrix: Format, Actionlint, TOML Format, Repository Contract, NPM Package, Cargo Deny, Repo Contracts, Clippy, and full Test. Targeted wire tests additionally prove: no mutation before MRTR confirmation; accepted retry executes once; replay/tamper is rejected; changed target occurrences invalidate confirmation; modern result discriminators/cache hints are present; legacy wire shape is preserved.

Merge sequencing

Keep this PR draft and do not merge it ahead of #129. Once #129 lands, rebase this stack onto current main, resolve any interaction with #130's Fleet/Code Mode changes, rerun the full matrix, and then do the final merge review.