2025-11-25 spec compliance fixes + JuliaC trim-compile harness

[quinnj]

Summary

Bring the implementation into compliance with MCP 2025-11-25. Add the standard JuliaC --trim=safe compile harness used across JuliaServices packages.

Spec compliance fixes

• Return deterministic ordering from tools/list, prompts/list, resources/list, and resources/templates/list.
• Return -32602 for unknown tools and prompts. Return -32002 for unknown resources.
• Parse SSE-streamed POST responses. Dispatch interleaved notifications and server requests before returning the final response.

Trim-safe static server

• Include the tools-only StaticMCPServer work from Add a trim-safe static tools server #3 without adding exports.
• Keep the request and dispatch graph concrete for JuliaC --trim=safe builds.
• Replace dynamic JSON parsing in the trim path with a strict scanner.
• Reject malformed escapes, numbers, Unicode, trailing bytes, excessive nesting, duplicate envelope fields, and invalid parameter shapes.
• Validate required initialize fields, tool schemas, annotations, and structured result objects.
• Preserve JSON-RPC string, null, integer, decimal, exponent, and large numeric IDs exactly.
• Do not execute request-only methods when a client omits the JSON-RPC ID.
• Convert argument and handler failures to stable JSON-RPC errors without leaking internal exception text.
• Document the namespaced API, route setup, handler contract, and support limits.

Integration updates

• Merge the current main branch, including OAuth 3 compatibility and retained negotiated client capabilities.

Validation

• Full package suite passes on Julia 1.12.6 with HTTP 2.6.1 and OAuth 3.0.0.
• JuliaC --trim=safe verification reports zero verifier errors or warnings. The produced executable passes.
• Full package suite passes on the minimum supported Julia 1.10.11 in a clean environment.
• Documenter 1.17 builds all pages and runs the new executable example.
• git diff --check passes.

Co-authored by Codex