fix: enforce monotonic progress notifications

[Genmin]

Summary

Fixes #1001.

Progress notifications now track the last reported progress value per in-flight request and reject non-increasing updates before they can reset the request timeout or reach the progress callback. The tracking state is cleared anywhere the progress handler is removed, including normal responses, cancellations, task cleanup, and connection close.

Validation

• pnpm --filter @modelcontextprotocol/core test -- packages/core/test/shared/protocol.test.ts -t "progress notification timeout behavior"
• pnpm --filter @modelcontextprotocol/core typecheck
• pnpm --filter @modelcontextprotocol/core lint
• pre-push hook: typecheck:all, build:all, lint:all

[changeset-bot]

🦋 Changeset detected

Latest commit: 0fde67b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@modelcontextprotocol/core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@1982

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@1982

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@1982

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@1982

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@1982

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@1982

commit: 0fde67b

[Genmin]

Added the missing patch changeset for the touched core package. The previous red matrix jobs were isolated to the unrelated Miniflare Cloudflare Worker Network connection lost failure, so this should at least clear the release-metadata blocker and trigger a fresh run.