v0.5.428 — Clarify the webMCP boundary
Adds an Agent-oriented note for official discussion #4971. Distinguishes the current Host-composed Streamable HTTP MCP client from browser-native webMCP, marks webMCP as not verified, and lists the origin, consent, lifecycle, credential, prompt-injection, naming, and teardown contracts a future implementation must define.
Validation: npm run check; npm run check:resources.