fix: use latest MCP client for protocol and CIMD login

[kody-bot]

Intent

Use the latest MCP TypeScript client for everything — protocol and OAuth. Do not start the official CLI on SDK v1 or deprecated dynamic client registration.

Summary

• Drop @modelcontextprotocol/sdk entirely. MCP calls and login both use @modelcontextprotocol/client 2.0.0.
• Pin MCP 2026-07-28 so Kody routes to the existing stateless /mcp lane (ADR 0005). No GET SSE session lock.
• Login is CIMD (SEP-991): client_id is {origin}/oauth/cli-client-metadata.json, redirect is the fixed loopback http://127.0.0.1:43742/callback.
• The OAuth provider seeds that client_id so the SDK never falls back to DCR.
• Adds CLI-scoped copies of Kody's ship-pr and orchestrate skills (AGENTS.md indexes them).
• Production login depends on kentcdodds/kody#1611 being deployed so the CIMD document exists. Until then, kody login will get invalid_client against production. whoami / search / execute still work with an existing token.

Testing

• npm run validate: typecheck, 15 tests, build.
• New unit test: CIMD URL, fixed loopback redirect, seeded client_id.
• Existing unit test: first request is POST server/discover with Mcp-Protocol-Version: 2026-07-28; no GET.
• Earlier production smoke (existing token, throwaway user) confirmed whoami / search / execute on the 2026-07-28 lane. Fresh CIMD login cannot be smoked against production until kody#1611 deploys.

[kody-bot]

@coderabbitai review

[github-actions]

🎉 This PR is included in version 1.0.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀