2025-11-25 compliance polish: probe version, filter errors, version stance

[JAORMX]

Part of #5743 (Workstream B: 2025-11-25 compliance). Bundles three small, independent polish items (consolidates #5750, #5751, #5752 — each is roughly an afternoon and they don't warrant separate tracking).

1. Readiness probe protocol version

The runner's readiness probe hardcodes "protocolVersion": "2024-11-05" in its initialize and the MCP-Protocol-Version header (pkg/runner/runner.go:935,986). Servers that reject ancient versions fail readiness.

• Send a current protocol version (SDK latest, or configurable per workload).

2. JSON-RPC error for filtered tool calls

The tool-call gating middleware returns HTTP 400 when blocking a filtered tool (pkg/mcp/tool_filter.go, acknowledged in a comment). Clients expect a protocol-level error.

• Return a proper JSON-RPC error over the negotiated response mode; keep 400 only for malformed HTTP/JSON.

3. Version-agnostic proxying: document + optional strict mode

Proxies accept any MCP-Protocol-Version (pkg/transport/proxy/streamable/utils.go — unconditional true). Defensible for a transparent proxy, but undocumented; spec says invalid/unsupported → 400.

• Document the stance in docs/arch/.
• Add an opt-in strict validation mode (400 on invalid/unsupported, assume 2025-03-26 when absent). Becomes more relevant for 2026-07-28 dual-protocol version detection.

Generated with Claude Code