fix(deps): re-narrow the mcp cap to <2.0 and correct its rationale

pyproject.toml

@@ -33,20 +33,20 @@ dependencies = [
     "fastmcp>=3.3.1,<4",
     "filelock>=3.13",
     "httpx>=0.27.0",
-    # Pinned because src/hive/_compat.py monkey-patches private
-    # attributes on mcp.shared.session.RequestResponder
-    # (_completed, _on_complete, _entered, _cancel_scope, __exit__,
-    # respond). Any minor bump can rename these silently. Upstream
-    # tracker for the cancel-race the shim fixes:
-    # https://github.com/modelcontextprotocol/python-sdk/issues/2610
+    # Pinned because src/hive/_compat.py monkey-patches
+    # mcp.shared.session.RequestResponder.respond and reads the private
+    # attributes _completed and _entered. Any minor bump can rename
+    # these silently. Upstream tracker for the cancel-race the shim
+    # fixes:
+    # https://github.com/modelcontextprotocol/python-sdk/issues/2416
     # Cap at <2.0 so a deliberate review happens before adopting
     # any new major release. Bump the lower bound when verifying a
     # newer release; bump the upper bound only after auditing the
     # _compat shim against the new internals.
     # 1.27.2 audited 2026-05-31: tests/test_compat_shim.py (incl. the
     # real-subprocess cancel-race) passes — the patched RequestResponder
     # internals are unchanged.
-    "mcp>=1.27,<3.0",
+    "mcp>=1.27,<2.0",
     "psutil>=5.9.0",
     "pydantic-settings>=2.0",
     "pyyaml>=6.0",