v0.5.2

v0.5.2

A patch release. One user-facing fix, plus module and CI hygiene. No protocol
changes and no breaking API changes.

Fixed

• ctx now reaches the wire, so an ordinary MCP call is cancellable.
  Client.callImpl accepted a ctx, spent it on trace-context capture, then
  called callDirect(method, params) without it. Its middleware terminal
  handler was written func(_ context.Context, ...). Downstream,
  streamableClientTransport.callWithContext defaulted reqCtx to
  context.Background() and used a real one only when the caller had
  hand-built a CallContext.

  The one caller that did was events/stream, whose Stop() needs to close its
  connection. Context threading was added for that case and never generalized,
  so for every other caller ctx was decorative: cancelling it did nothing, a
  deadline did nothing, and a wedged tool call could only be escaped by tearing
  the client down.

  callDirect now takes a ctx and carries it as CallContext.Context. The
  middleware terminal handler passes the ctx the chain hands it rather than
  the one captured at entry, so middleware deriving a bounded ctx bounds the
  request it wraps. Client.CallContext, which ignored its ctx argument
  entirely, now fills a nil cc.Context from it while leaving an explicitly
  built NewCallContext alone: a caller who constructed one is stating intent
  and wins over the ambient argument.

  Only the streamable HTTP transport honours cancellation. Legacy SSE and the
  core adapter document that they ignore cc, which is unchanged.

• Five placeholder module pins resolve. scripts/verify-submodule-deps.sh
  parsed only the root github.com/panyam/mcpkit require and skipped sibling
  requires, so placeholder versions could sit in the tree and pass CI. The
  blind spot is closed and the pins are resolved.

Changed

• Extension isolation is enforced by a gate rather than a comment. C4 said
  one extension module must not directly require another, and the verifier was
  a shell block pasted inside CONSTRAINTS.md that nothing ran.
  scripts/check-ext-isolation.sh now runs in CI. Membership derives from the
  module path rather than a hardcoded directory list, so a new extension tree is
  covered the day it appears.

• The agent SDK left the release train. agent/ moved to
  experimental/agent/ and its modules are absent from SUB_MODS_TO_TAG. They
  are not tagged by this release and carry no compatibility promise. See
  VERSIONING.md § Agent SDK.

Development dependencies

• esbuild 0.28.1 to 0.28.2 in ext/ui/assets.