v1.4.0 — MCP server speaks both spec revisions

Our own mcp-vet flagged the bundled MCP server (npx npm-script-lens mcp) as BREAKING against the 2026-07-28 spec: that revision removes the initialize / notifications/initialized handshake and carries protocolVersion, clientInfo and capabilities in params._meta on every request instead.

Deleting the handler would have satisfied the linter and broken every client in the field. So this does what mcp-vet's own guidance prescribes — "your rollout is a window, not a day" — and supports both revisions:

• absorbMeta() reads _meta off every incoming request (2026-07-28 path)
• the initialize handler stays for 2025-11-25 clients, and now echoes the _meta-negotiated version when the request omits one
• the residual static finding is suppressed with a justification rather than left as a permanent red CI step

Verified on the wire in both directions: a 2025-11-25 client gets its handshake reply; a 2026-07-28 client calls tools/list with no handshake at all. 201/201 tests pass.