Maintenance pass. No runtime API changes for this server — the framework's
HTTP Origin fail-closed default, landing requireAuth bearer validation,
log-payload removal, format-parity numeric tightening, and z.literal union
exemption all apply to surfaces this server doesn't currently use.

- @cyanheads/mcp-ts-core 0.7.0 → 0.7.5
- fast-xml-parser 5.7.1 → 5.7.2 (stack-overflow fix on long tags)
- MCP SDK ^1.29.0 via the framework
- Skills synced: api-linter 1.1→1.2, maintenance 1.5→1.6, field-test +
  design-mcp-server content refreshes (description leak audits)
- Scripts synced: scripts/devcheck.ts, scripts/check-framework-antipatterns.ts
- CLAUDE.md / AGENTS.md form-client safety bullet names the union+literal
  alternative

Field-tested against PMID 38785209 (live NCBI) — abstract correctly
preserves '1.73 m² of body-surface area', confirming v2.6.1 inline-markup
flatten path survives the parser bump.

462 tests passing (4 skipped). devcheck green across 11 checks.