Swaps all github.com/mark3labs/mcp-go/{mcp,server,client,client/transport}
imports to the go-sdk-backed compatibility shim in toolhive-core
(github.com/stacklok/toolhive-core/mcpcompat/*). No call-site logic changes —
the shim mirrors mcp-go's API. This moves ToolHive's MCP protocol handling
onto the official modelcontextprotocol/go-sdk.

Depends on stacklok/toolhive-core#150; the toolhive-core dependency is pinned
to that branch commit and should be bumped to the released version once #150
merges.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Add Serve-path regression tests and bridge list_changed re-fetch

Pin current mcpcompat shim behavior for session lifecycle,
capability advertisement, tool schema fidelity, and concurrent
context isolation so the go-sdk migration can be validated.

Fix bridge to re-fetch tools/resources/prompts when a list_changed
notification arrives, keeping the local stdio server's advertised set
in sync with the upstream backend.

Two real regressions found and pinned with documented assertions:
- Initialize response advertises only {logging:{}} instead of
  capabilities.tools and capabilities.resources (toolhive-core#156 U1)
- normalizeObjectSchema replaces schemas without type:object with
  a bare {type:object}, dropping properties and required fields
  (toolhive-core#156 U6)

Refs #5742

* Add auth-error mapping, Host-header, and HeartbeatInterval config

Pin current mcpcompat shim behavior for auth error classification
and local proxy Host-header rewriting. Add configurable
HeartbeatInterval to ServerConfig for testable SSE keep-alive.

Tests cover 401 to ErrAuthenticationFailed, 403-on-initialize to
legacy SSE fallback, tool errors with auth-looking messages not
being misclassified as auth failures, and Host-header rewriting in
the transparent proxy.

Key finding: the streamable-HTTP transport does not return
transport.ErrLegacySSEServer for 403 responses (only the SSE
transport does), so the sentinel is not in the error chain.  The
error is still classified as ErrBackendUnavailable via string
matching.  Pinned with documented assertions.

Refs #5742

* Add SSE keep-alive, pagination, projection, and sliding TTL tests

Pin current mcpcompat shim behavior for SSE keep-alive cadence,
tool pagination, per-session tool projection with Cedar authz,
and sliding session TTL so the go-sdk migration can be validated.

Tests cover keep-alive bytes on idle SSE streams, >1000 tool
listing behavior (skipped — known pagination gap), two sessions
with different authz outcomes seeing different tools, filtered
tools being uncallable, session tool sets being fixed at
initialize, and active sessions not expiring despite TTL elapsing.

Add WithSessionTTL helper option for integration tests.

Refs #5742

* Add stdio bridge notification forwarding regression tests

Pin the current mcpcompat shim behavior for the stdio bridge's
list_changed re-fetch fix and document known shim limitations.

Test covers the forwardAll re-sync when a tools/list_changed
notification arrives from the upstream backend, verifying the
bridge's local server picks up the updated tool set.

Skipped test documents that progress and logging notifications are
dropped by the mcpcompat client shim (no ProgressNotificationHandler
or LoggingMessageHandler installed) and that list_changed
notifications cannot be forwarded downstream (SendNotificationToAllClients
only handles progress and message).  Serves as regression anchor
for when the shim is fixed.

Refs #5742

* Fix codespell: rename rIn/wIn to pipeR/pipeW in bridge test

Codespell flagged rIn as a potential misspelling (ring/rink/rain).
Rename to pipeR/pipeW to avoid the false positive.

Refs #5742