[cc] bump @modelcontextprotocol/sdk to latest minor (track Apr 2026 SDK)

[anipotts]

Source: Apr 2026 conventions audit

Problem

`plugins/cc/package.json` pins `@modelcontextprotocol/sdk: ^1.12.1`. As of Apr 2026 the SDK has moved several minors past this; we may be missing:

• Updated capability namespaces
• Improved Server/Transport ergonomics
• Bug fixes in stdio transport
• Type improvements

Fix

`bun update @modelcontextprotocol/sdk --latest` then verify:

1. Smoke test passes (initialize + tools/list + tools/call)
2. Capabilities object still accepts `experimental` key
3. `server.notification(...)` API unchanged
4. zod-to-json-schema still produces compatible output

Acceptance criteria

• @modelcontextprotocol/sdk on current minor
• No smoke-test or unit-test regressions
• CHANGELOG note (after CHANGELOG issue lands)

[github-actions]

@claude please triage this issue per .github/AI_REVIEW_RUBRIC.md (issue-triage section).