SDKs: expose MCP server instruction policy

[OllieinCanada]

Fixes #2379

Summary

• expose the optional MCP server instruction policy in the Node.js, Python, Go, Rust, .NET, and Java session APIs
• forward explicit true and false values through both session.create and session.resume
• omit the field when it is not configured, preserving the runtime's allowlist-based default
• update the branch to current main

The generated runtime protocol already supports allowAllMcpServerInstructions. This fills the missing public create/resume path consistently across every SDK without changing the generated protocol schema.

Security

Enabling this option broadens the session's instruction trust boundary. Each public API documents that caveat, and no SDK enables it by default or coerces an omitted value.

Tests

Deterministic wire/serialization tests cover explicit true, explicit false, and omission for create and resume in every SDK.

Local validation:

• Node.js focused Vitest regression: 3 passed; typecheck passed
• Python focused client regression: passed
• Go focused request regression: passed
• Java focused create/resume regressions: 2 passed; JDK 25 compilation and Checkstyle passed
• .NET public create/resume wire regressions: 3 passed on .NET 8 with SDK 10
• git diff --check for the PR delta: passed

Rust is covered by the repository's fresh CI matrix; its local toolchain was unavailable in this workspace.

[SteveSandersonMS]

Thanks for the Node support here — the fix is clean, well-tested, and matches the existing mcpServers pattern in client.ts.

Since allowAllMcpServerInstructions already exists in the generated RPC layer for all 6 SDKs (Go, Python, Rust, .NET, Java, Node), exposing it only in Node leaves the same gap open for the other five languages — anyone setting it there today has it silently dropped, same as the bug this PR fixes for Node. Could you extend this PR to expose and forward the field consistently in C#, Python, Go, Rust, and Java as well, following the same create/resume wiring approach?

For each language, focused unit/wire-level tests covering explicit true, explicit false, and omitted (mirroring the 3 Node tests here) would be great — full E2E MCP tests aren't needed beyond that unless a particular language's test setup makes it uniquely useful.

Once all languages are covered, please mark the PR ready for review. Thanks again!

[OllieinCanada]

Implemented the requested cross-SDK expansion in 0b864461 and updated the branch to current main.

Node.js, Python, Go, Rust, .NET, and Java now all expose and forward the option for create and resume. Each language has wire/serialization coverage for explicit true, explicit false, and omission. Local focused checks passed for Node.js, Python, Go, and Java (including JDK 25 compilation and Checkstyle); fresh CI will validate the Rust and .NET toolchains. I have marked the PR ready for review.

[OllieinCanada]

Follow-up ed361202 strengthens the .NET coverage by exercising the public create/resume APIs through the repository fake server. All three true/false/omitted cases pass locally on .NET 8 with SDK 10.

[emmanuelik0147-rgb]

Th