rustsdcmcp v0.6.0

Added

• --tool-mode full|compact (env MCP_TOOL_MODE, default full): compact lists only list_sdc_resources, get_sdc_resource, get_sdc_tenant_scope and the four change-set tools. Listing only; every tool stays callable within the token's scope. (#285)

Changed

• Bumped the mecmcp dependency pin from v0.27.0 to v0.31.0, together with the
  tag and SBOM guards in CI, packaging, and the installer. This is a pin bump
  only: no new mecmcp feature (OAuth resource mode, device selectors, verified
  proposer, whoami) is enabled. (#285)

Upgrade notes

• Token names starting with oauth: are now reserved. A static token file
  containing one fails to load as a whole (every token is refused), so rename
  any such token before upgrading.
• Every per-call audit line gains oauth_issuer=, oauth_subject= and
  oauth_client_id= fields (empty for static-token callers), and an
  identity_mechanism field. Parsers must tolerate them.
• Rollback: once an OAuth caller has created a change set, a pre-0.29 binary
  cannot read the change-set state file. This server does not expose the OAuth
  resource-server flags, so it does not apply here unless that is enabled later.