Bump to 2.0.0 and widen SDK peer ranges to ^2.0.0

The client, core and server packages become ^2.0.0 peers and client is
now a required peer (App and AppBridge extend its Protocol class);
server stays optional for View-only consumers. Examples move to
zod ^4.2.0 to match the library peer range.

The root package is not yet published at 2.0.0, so the lockfile now
links the examples' @modelcontextprotocol/ext-apps dependency to the
repository root instead of a registry copy. This drops the stale 1.x
tarball (and its sdk 1.x peer) from the lockfile and makes
scripts/link-self.mjs a no-op.

examples/qr-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/server-qr",
-  "version": "1.7.5",
+  "version": "2.0.0",
   "private": true,
   "scripts": {
     "start": "uv run server.py",
@@ -8,6 +8,6 @@
     "build": "echo 'No build step needed for Python server'"
   },
   "dependencies": {
-    "@modelcontextprotocol/ext-apps": "^1.7.0"
+    "@modelcontextprotocol/ext-apps": "^2.0.0"
   }
 }