feat(mcp): resolve modern long-running tasks

[dajiaohuang]

Problem

The hosted Agent could negotiate MCP 2026-07-28 tool calls, but it did not implement SEP-2663 server-directed Tasks. Pinned-modern SDK connections also synthesized discovery, so real server extension capabilities were hidden. The final component lock still referenced pre-identity/pre-Tasks domain revisions.

Solution

• add a public SDK ResultClaim/resolver for the io.modelcontextprotocol/tasks extension
• keep short tools synchronous while dynamically extending only claimed long-tool deadlines
• poll, update, and cancel with SEP-2663 request models and Mcp-Name=taskId
• sign a fresh audience-bound delegation-v2 for every tasks/get, tasks/update, and tasks/cancel; retain the trusted requester/resource owner/acting host/campaign/turn/base revision outside model-controlled arguments
• require real server/discover for configured MCP 2026-07-28 connections and fail closed on version downgrade or missing Tasks capability
• give the official Host auth bridge the same Tasks and real-discovery behavior across stdio and Streamable HTTP
• pin the final modern SagaSmith stack to Core eef98fcf, D&D 587f66e0, CoC 515f6a7e, and Narrative 3f369440
• document taskTimeout separately from the synchronous toolTimeout

Verification

• pytest -q: 5382 passed, 73 skipped
• focused Tasks/Host/lock tests: 60 passed
• connection and Host contract tests: 143 passed
• Ruff: passed
• git diff --check: passed
• real D&D head 1ba02ec1 (merged as 587f66e0): Agent Host completed module_draft through SEP-2663 over both stdio and Streamable HTTP after real capability discovery

No release is published by this PR.