v0.4.1 — logging, and dependencies that stay where they were tested

Two corrections to 0.4.0, neither visible in normal use.

Diagnostics go through logging. They were a print to stderr with the message already formatted, so every call paid for its own interpolation whether or not anything would read it, there was no level to turn down, and a host had no way to route the output. Lines are now lazily interpolated and levelled — what a session did at info, what it dropped at warning — and YAAC_LOG_LEVEL sets the threshold. The stderr handler is attached by the entry points rather than on import: stdout carries the MCP transport, and a library that configures logging decides that for whoever imported it.

The dependencies gained ceilings. mcp>=1.2 had none, and as of today it resolves to 2.1.1 — a major version 0.4.0 shipped without having ever been run against, whose LATEST_PROTOCOL_VERSION is already the 2026-07-28 revision. Both dependencies are now ~= on what the suite actually runs: mcp~=2.0, pyzmq~=27.0. Nothing about the protocol YAAC speaks changes; the point is that the version it speaks it with is now a decision rather than whatever resolved this morning.