[Server] Close the conformance gaps in the modern lifecycle (#447)

* [Server] Let the client gateway see modern-era capabilities

The six supports*() probes read session state only InitializeHandler wrote,
so every request served statelessly reported no client capabilities at all —
a tool guarding on them took the unsupported branch without a signal.
StatelessProtocol now writes the request's declaration under the same keys.

* [Server] Reject the RPCs 2026-07-28 removed

resources/subscribe and resources/unsubscribe were still dispatched and
answered 200 OK, recording subscriptions the modern era never reads. They
join initialize, ping and logging/setLevel in the era guard; the handlers
stay registered because the handshake era still serves them.

* [Server] Decode a wrapped Mcp-Name before comparing it

The Base64 sentinel was only unwrapped for Mcp-Param-*, so any resource URI
or tool name outside the header-safe ASCII set — which the spec explicitly
tells clients to wrap — was compared encoded and refused with -32020.

* [Server] Require the MCP-Protocol-Version header

It was only checked for contradicting the body, so omitting it entirely
passed — leaving the value intermediaries route on unenforced. Tied to the
header validator's presence, since that is what a header-bearing transport
installs and stdio carries its metadata inline.

* [Server] Read the modern-era request body whole

A single read() takes whatever the stream cares to give — 64 bytes from a
chunked transfer is legal — so an oversized-but-valid POST came back as a
parse error. Shares the legacy transport's incremental read as a trait.

* [Schema][Server] Answer a notification with a status, not a response

A body with no id was dispatched as a request and came back as a JSON-RPC
error carrying "id": "" — an id nobody issued, and on a path a client uses
to tell a modern server from a legacy one. Notifications now get 202 and no
body, and Error omits an id it could not read instead of emptying it.

* [Server] Stop emitting the error codes 2026-07-28 reserved

resources/read answered -32002, which this revision forbids; prompts/get
and completion/complete answered it for an unknown *name*, which it never
meant; tools/call answered -32601, which belongs to an unknown method.
Only the resources/read code is revision-gated — older peers expect -32002
there, and nowhere else. Also routes the -32021 capability exception out of
the prompt and resource handlers, which were swallowing it into -32603.

tests/Unit/Server/Transport/Fixture/ShortReadStream.php

@@ -0,0 +1,110 @@
+<?php
+
+/*
+ * This file is part of the official PHP MCP SDK.
+ *
+ * A collaboration between Symfony and the PHP Foundation.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Mcp\Tests\Unit\Server\Transport\Fixture;
+
+use Psr\Http\Message\StreamInterface;
+
+/**
+ * A non-seekable stream that hands back at most $chunkSize bytes per read.
+ *
+ * Models what PSR-7 actually promises — *up to* the requested length — which a
+ * stream over `php://input` or a chunked transfer delivers routinely, and which
+ * a single `read($cap)` therefore truncates.
+ */
+final class ShortReadStream implements StreamInterface
+{
+    private int $offset = 0;
+
+    public function __construct(
+        private readonly string $contents,
+        private readonly int $chunkSize = 64,
+        private readonly bool $advertiseSize = true,
+    ) {
+    }
+
+    public function read(int $length): string
+    {
+        $chunk = substr($this->contents, $this->offset, min($length, $this->chunkSize));
+        $this->offset += \strlen($chunk);
+
+        return $chunk;
+    }
+
+    public function eof(): bool
+    {
+        return $this->offset >= \strlen($this->contents);
+    }
+
+    public function getSize(): ?int
+    {
+        return $this->advertiseSize ? \strlen($this->contents) : null;
+    }
+
+    public function isSeekable(): bool
+    {
+        return false;
+    }
+
+    public function __toString(): string
+    {
+        return $this->contents;
+    }
+
+    public function getContents(): string
+    {
+        return substr($this->contents, $this->offset);
+    }
+
+    public function close(): void
+    {
+    }
+
+    public function detach()
+    {
+        return null;
+    }
+
+    public function tell(): int
+    {
+        return $this->offset;
+    }
+
+    public function seek(int $offset, int $whence = \SEEK_SET): void
+    {
+        throw new \RuntimeException('Not seekable.');
+    }
+
+    public function rewind(): void
+    {
+        throw new \RuntimeException('Not seekable.');
+    }
+
+    public function isWritable(): bool
+    {
+        return false;
+    }
+
+    public function write(string $string): int
+    {
+        throw new \RuntimeException('Not writable.');
+    }
+
+    public function isReadable(): bool
+    {
+        return true;
+    }
+
+    public function getMetadata(?string $key = null)
+    {
+        return null === $key ? [] : null;
+    }
+}