Composer: require stable mcp/sdk ^0.8.1 (v0.3.0)

[f3l1x]

Summary

Moves mcp/sdk from the dev-main#3699323… commit pin to the stable ^0.8.1 release, with the code changed to match the new API.

• TraceableRegistry now matches the new RegistryInterface:
  • register*() return their references.
  • New unregister*() and has*() methods.
  • clear() and get/setDiscoveryState() are removed.
  • Resource is renamed to ResourceDefinition.
• Psr16StoreSession is renamed to Psr16SessionStore.
• StreamableHttpTransport no longer takes the $corsHeaders argument, so the transport now uses the SDK's default middleware.
• nette/di and symfony/finder move to require. symfony/finder is needed for file-based discovery. The optional integrations (application, http, console, tracy) are listed under suggest.
• Fixes the composer.json description, keywords and homepage, which were copied from doctrine-dbal.
• Bumps the branch alias to 0.3.x-dev and adds the version table to the README.
• Small fixes found by phpstan: tag value validation in BuilderMan, the tempDir type check, Nette header handling in GuzzleBridge.

Commits

• Composer: fix package description, keywords and homepage
• DI: validate tag values in BuilderMan
• Composer: require stable mcp/sdk ^0.8.1
• Code: tighten types reported by phpstan
• Composer: require nette/di and symfony/finder, suggest optional integrations
• Composer: bump branch alias to 0.3.x-dev
• Docs: update versions table

QA

• make cs: passes
• make phpstan (level 9): passes
• make tests: 12 tests pass
• composer update --prefer-lowest, then tests and phpstan: pass (mcp/sdk 0.8.1, nette/di 3.2.5, nette/http 3.3.3, nette/application 3.2.8)

Needs a decision before release

With the SDK default middleware, StreamableHttpTransport now runs DnsRebindingProtectionMiddleware (on top of CORS and protocol-version validation). Its allowlist only includes localhost, 127.0.0.1 and [::1]. GuzzleBridge forwards the real Host/Origin headers, so a non-localhost deployment of the HTTP transport will get 403 Forbidden: Invalid Host header. We probably need an allowedHosts (or middleware) option in the extension, or at least a documented custom TransportFactory. This PR does not include that yet.

Proposed version: v0.3.0

v0.2.0 was tagged from master before this PR (with the old dev-main pin), so this becomes v0.3.0.

This is a breaking change within 0.x. The public TraceableRegistry API and the SDK types users touch have changed, the SDK HTTP security defaults now apply, and there are new runtime requirements.

Draft release notes (v0.2.0...v0.3.0)

Breaking

• Require stable mcp/sdk ^0.8.1 instead of the dev-main commit pin. Attribute-based tools, resources and prompts work as before, but code that uses the SDK API directly may need changes (for example Resource is now ResourceDefinition and Psr16StoreSession is now Psr16SessionStore).
• TraceableRegistry follows the new RegistryInterface: register*() return references, unregister*()/has*() are added, and clear() and the discovery-state methods are removed.
• The HTTP transport uses the SDK default middleware (CORS, DNS rebinding protection, protocol version validation).
• nette/di and symfony/finder are now required at runtime.

Fixes

• Validate DI tag values in BuilderMan
• Tighten tempDir and header types reported by phpstan (fixes red phpstan on master)
• Fix composer.json description, keywords and homepage

Docs / Chore

• Versions table in README

Not tagging or releasing yet. That is left to the maintainer.