feat(mcp): add @gemstack/mcp — agent-agnostic MCP server framework (Phase 1)

[suleimansh]

Phase 1 of the @gemstack/mcp graduation. Design + locked decisions: #18. Build issue: #19. Family epic: #1.

Stands up @gemstack/mcp as a standalone, agent-agnostic MCP server framework — the server-authoring axis of the MCP taxonomy, peer of @gemstack/ai-mcp (the agent bridge). It depends on no AI runtime, and ai-sdk must never depend on it.

What landed

Lifted the framework-agnostic core out of @rudderjs/mcp and applied the locked decisions:

• Strip Rudder wiring (Decision 1): removed provider.ts (McpProvider), the make-* CLI scaffolders, doctor.ts, and the inspector from the core — these stay with the @rudderjs/mcp binding in Phase 2 (Build: @gemstack/mcp Phase 2 — repoint @rudderjs/mcp onto the core (thin binding) #20). Kept Mcp / McpServer / McpTool / McpResource / McpPrompt / McpResponse, the decorators, observers, runtime, testing.
• DI resolver seam (Decision 2): replaced the globalThis.__rudderjs_* container read with an instance-scoped McpResolver passed at construction — new MyServer({ resolver }). @Handle resolves at call time off the server instance; built-in createResolver().register(token, instance) for the no-container case. A @Handle dependency with no resolver, or a resolver that yields undefined, throws a loud error naming the member + token — never injects undefined. No global setter.
• Framework-neutral HTTP (Decision 3): createMcpHttpHandler(server) returns a plain node:http (req, res) handler (also fits Express/Connect); createWebRequestHandler(server) returns a Web Standard (request) => Promise<Response> engine for Hono/Vike/edge runtimes.
• Generic OAuth2 (Decision 4): oauth2McpMiddleware re-typed to a Connect (req, res, next) signature taking a user-supplied verifyToken; dropped the @rudderjs/core MiddlewareHandler import and the passport lazy-load (passport is wired by the binding, not here).
• Drop @rudderjs/json-schema (Decision 5): inline Zod 4 native z.toJSONSchema with the z.date() -> string/date-time override + open-object fallback. Zero behaviour change.
• Versioning (Decision 7): fresh 0.0.0 -> 0.1.0 via a minor changeset (matches the family convention).

Runtime deps collapse to @modelcontextprotocol/sdk + zod + reflect-metadata. Zero @rudderjs/*, and nothing imported from @gemstack/ai-*.

Acceptance

• pnpm build + pnpm typecheck + full suite green standalone (100 tests, zod + node:test).
• A server authored with only @gemstack/mcp serves over createMcpHttpHandler on raw node:http, no framework present (new integration test using the SDK's real StreamableHTTPClientTransport).
• @Handle works three ways: via a passed resolver, via createResolver().register, and a no-@Handle tool needs no resolver; a missing resolver / undefined resolution throws a clear named error.
• One-directional dep check: imports nothing from @gemstack/ai-*; deps = SDK + zod + reflect-metadata.
• Publish @gemstack/mcp@0.1.0 — on merge, via the release workflow (no pending changeset blocks it).

Notes

• The boost/ Claude-skill docs were not carried over: they document the Rudder-flavored authoring (CLI scaffolders, provider, globalThis-container DI) which no longer matches the agnostic core (resolver seam, neutral handler, no CLI). Agnostic-core skill docs belong to Phase 3 (Build: @gemstack/mcp Phase 3 — framework-neutral quickstart/docs (optional) #21); the existing docs stay with the binding.
• Phase 2 (Build: @gemstack/mcp Phase 2 — repoint @rudderjs/mcp onto the core (thin binding) #20) repoints @rudderjs/mcp onto this core as the thin Rudder binding (provider, container resolver, CLI, doctor, inspector).

Closes #19.