mcpcompat: reconcile removals in per-session resource/template/prompt sync

[JAORMX]

Context

In mcpcompat/server/session.go, syncSessionTools reconciles the per-session go-sdk server against the overlay by both adding new tools and removing ones no longer present (srv.RemoveTools(removed...)). The sibling syncs for the other capability kinds are add-only:

• syncSessionResources
• syncSessionResourceTemplates
• syncSessionPrompts

None of them removes entries that are absent from the new overlay, even though go-sdk exposes RemoveResources / RemoveResourceTemplates / RemovePrompts.

Impact (downstream in toolhive)

toolhive's vMCP list_changed propagation (stacklok/toolhive#5965 for tools, stacklok/toolhive#5969 for resources/prompts) re-derives a session's advertised capabilities on a backend list_changed and applies them with the REPLACE-style SetSessionResources/SetSessionResourceTemplates/SetSessionPrompts. Because the underlying sync is add-only:

• Additions to a backend's resources/templates/prompts propagate to the client correctly.
• Removals do not — a resource/prompt the backend dropped stays registered on the session's go-sdk server and keeps appearing in resources/list / resources/templates/list / prompts/list until the session re-initializes.

Tools do not have this problem because their sync reconciles removals.

Note: read-time access is unaffected downstream (toolhive re-derives admission per call), so this is a stale-list / name-disclosure issue, not an access bypass.

Proposed change

Mirror syncSessionTools' removal reconciliation in syncSessionResources, syncSessionResourceTemplates, and syncSessionPrompts: track the previously-synced names/URIs and call the corresponding go-sdk Remove* for entries absent from the new overlay.

Acceptance

• A REPLACE-style SetSessionResources/SetSessionResourceTemplates/SetSessionPrompts that omits a previously-present entry results in that entry being removed from the session's go-sdk server (and a downstream list_changed emitted).
• After a toolhive-core release + bump, the add-only guard tests in Propagate backend resources/prompts list_changed in vMCP toolhive#5969 (serve_session_test.go, which currently assert removed entries still appear) can be flipped to assert removal, and the NOTE comments at resyncSessionResources/resyncSessionPrompts removed.

Reported from stacklok/toolhive#5969.