fix: reject a non-string protocolVersion, and drop the test double casts

Copilot review follow-ups:

- `applyProtocolVersion` took the value straight from an unvalidated JSON
  body and went to `RegExp.test`, which coerces — `123` and `true` both
  matched the token pattern and reached `Transport.setProtocolVersion` with
  the wrong type. It now takes `unknown` and checks `typeof === "string"`
  first, with cases for the coercible values.
- Replace `as unknown as Transport` in the new session fixtures with a
  `makeTransport()` helper returning a structurally valid `Transport`, so an
  interface change stays visible to the tests.
- Drop `as unknown as typeof fetch` in the new transport test —
  `vi.fn<typeof fetch>()` is already the right type.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0119LaPQ3v4NyBK3ZTdM9j84

clients/web/src/test/core/mcp/remote/remoteClientTransport.test.ts

@@ -542,10 +542,7 @@ describe("RemoteClientTransport", () => {
         return new Response("not found", { status: 404 });
       });
 
-    const transport = new RemoteClientTransport(
-      { baseUrl, fetchFn: fetchFn as unknown as typeof fetch },
-      config,
-    );
+    const transport = new RemoteClientTransport({ baseUrl, fetchFn }, config);
     await transport.start();
 
     // Pre-initialize sends carry no version (none negotiated yet).