v1.0.33

[v1.0.33]

• Recover MCP tool calls from stale inherited HASP_SESSION_TOKEN values,
  including sessions that no longer exist or point at a different project.
• Keep explicit MCP session_token values fail-closed while returning a clear
  diagnostic that tells agents to omit stale explicit tokens and let HASP open a
  fresh local MCP session.
• Restore release-blocking 100% Go statement coverage after the MCP hardening
  work and refresh the public export mirror.
• Raise Go modules to 1.26.4 to clear current Go stdlib OSV advisories before
  release.