fix: do not omitempty ReadOnlyHint in ToolAnnotations (#908)

`ReadOnlyHint` is a `bool` with omitempty, so the zero value (false) is
indistinguishable from unset, and **drops out** of marshaled JSON.

The current behavior causes an issue with the OpenAI MCP app submission
because they require explicit hints.

Consumers that explicitly set `ReadOnlyHint: false` on write tools lose
the field on the wire. Removing `omitempty` ensures `false` is always
serialized, which matches the MCP spec default.

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Maciej Kisiel <mkisiel@google.com>
Co-authored-by: guglielmoc <guglielmoc@google.com>

internal/docs/rough_edges.src.md

@@ -62,3 +62,8 @@ v2.
 - `StreamableHTTPOptions.CrossOriginProtection` should not have been part of
   the SDK API. Cross-origin protection is a general HTTP concern, not specific
   to MCP, and can be applied as standard HTTP middleware.
+
+- `ToolAnnotations` (`mcp/protocol.go`) should have all fields typed as `*bool`
+  for full control to define what is being sent over the wire. Different
+  MCP clients have different requirements, and some of them require all fields
+  to be explicitly set to either `true` or `false`.