Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) - #2547

The priming/resumability gate uses a bare lexicographic comparison (protocolVersion >= '2025-11-25') on a version string that, for initialize requests, comes verbatim from the request body and is never validated against SUPPORTED_PROTOCOL_VERSIONS — so any unsupported string sorting above the threshold ('draft', 'latest', '2026-01-01') enables priming events, closeSSEStream callbacks, and the new _resumableStreams silent-release path for a client the server will actually negotiate down. Main gua

Concurrent DELETE requests can invoke `onsessionclosed` twice for the same session: while the first DELETE is parked on `await Promise.resolve(this._onsessionclosed?.(...))` (line 982), `_closed` is still false (it's only set inside `close()`, which runs in the `finally` after the callback settles), so a second DELETE passes both the `handleRequest` `_closed` guard and `validateSession` and fires the callback again. Note this window also exists pre-PR and on main, so nothing regresses at merge —