Adopt go-sdk v1.7.0-pre.3 for MCP 2026-07-28 groundwork

[JAORMX]

Summary

Why: mcpcompat wraps go-sdk v1.6.1, which only speaks MCP 2025-11-25. The MCP 2026-07-28 ("stateless") revision — no initialize handshake, server/discover, no Mcp-Session-Id, ping removed — is implemented natively by go-sdk v1.7.x. Downstream ToolHive currently hand-rolls the 2026-07-28 wire path because the shim can't provide it; the point of this workstream is to replace that hand-rolled code with a shim-provided path backed by the real SDK.

What: This is PR1 of 3 in the Phase 1 mcpcompat stateless work — the foundational dependency bump. It does not add any stateless feature yet; it makes the shim build and pass on v1.7 and pins the one behavioral change the bump introduces.

• Bump go-sdk v1.6.1 → v1.7.0-pre.3. The shim compiles against v1.7 with zero production source edits — v1.7 is purely additive (382→491 exported symbols, no removals or signature changes), verified by an exported-symbol diff. No existing exported signature or shim-owned constant changes (drop-in contract preserved; mcp.LATEST_PROTOCOL_VERSION stays 2025-11-25, error-code constants unchanged).
• Directory-scoped staticcheck SA1019 exclusion for mcpcompat/. v1.7 deprecates the sampling/logging/roots surface (SEP-2577) that the shim intentionally retains for mark3labs/mcp-go drop-in parity. The exclusion comment notes it must be re-audited on every SDK bump.
• Regression tests pinning the one behavioral change (see below).

⚠️ Pre-release dependency — do not tag a release off this

v1.7.0 is not final (only pre.1/2/3 exist, and the 2026-07-28 wire surface is still settling between them). toolhive-core is a shared library, so a pinned pre-release propagates to every consumer via MVS. This PR adds two guards:

• an inline // PRE-RELEASE: marker on the go.mod require line, and
• a release.yml guard step that fails any release job while go.mod still pins a go-sdk -pre/-rc version.

Re-bump to v1.7.0 final before tagging. It's the first of a sequence and takes a pre-release dep — the code is independently mergeable and green, but please review the approach as a set.

Behavioral change this PR documents

v1.7's client Connect is Modern-first: it probes server/discover before falling back to the legacy initialize handshake. Against a stateful shim server this means one Initialize() now:

• negotiates down to 2025-11-25 as before (wire version unchanged), but
• mints two sessions (Generate×2): the discover probe + the legacy fallback. The discover-probe session leaks — go-sdk's discover handler sets InitializeParams (mcp/server.go:898-902), defeating the #578 cleanup guard (mcp/streamable.go:733), and SessionTimeout is unset — and the shim-layer placeholder record is never promoted/reaped.

This is an availability concern only (no identity/tool binding on the orphan — OnRegisterSession never fires). The stateful-server leak needs an upstream fix (export the client protocol-version pin, which is unexported today — the #5911 blocker); PR2's stateless-serving path avoids it for stateless backends. The regression test asserts the Generate−Terminate delta (2−1=1) as a tripwire so a future fix fails loudly.

Next in this series

• PR2: WithStateless server option + make the per-session projection/rehydration machinery no-op cleanly under stateless (per-request isolation).
• PR3: Modern client consumption surface + re-export the -3202x error codes / NeedsInput() for downstream.

Test plan

• task test (race) — all existing suites green + new regression tests
• task lint — 0 issues (SA1019 exclusion resolves the intentional deprecations)
• task license-check — clean
• go build ./... — clean, no source edits to mcpcompat/**

🤖 Generated with Claude Code