v0.26.0

Breaking (one change): McpError is now #[non_exhaustive] and has a new variant — a match over it needs a wildcard arm. Ships with yoagent-rutis 0.10.0 and yoagent-workers 0.3.0 (requirement bumps only, above).

• MCP over HTTP: a typed HTTP status on errors (asked for by yobuild). A non-success HTTP response is now McpError::Http { status, message } instead of McpError::Transport(text) — on calls, notifications (the connect handshake's included) and an expired session (404) — so a caller matches on the code (401/403: it wants a credential or a sign-in) instead of the text; McpError::http_status() -> Option<u16>. The variant is #[non_exhaustive] too (match Http { status, .. }; a custom transport builds one with McpError::http(status, message)), so fields can be added later. Typed where McpError reaches you — McpClient, connect_*, Agent::with_mcp_server_http*; a tool call the agent loop runs still reports the text to the model as a failed tool result. The displayed text is unchanged (Transport error: HTTP 401 Unauthorized from server on '…': …).
• MCP over HTTP: redirects stay within the server's origin by default (asked for by yobuild; a security fix). HttpTransport followed any redirect (up to 10): the HTTP client drops Authorization and Cookie on a hop to another host, but a custom header set with with_header (x-api-key, say) went wherever the server pointed, and nothing stopped https → http. It now follows redirects within the URL's own origin (scheme, host, port; up to 10) — a 307/308 from /mcp to /mcp/ still works — and a redirect anywhere else is an error naming where it pointed. HttpTransport::with_redirects(Redirects::None | SameOrigin | Any) chooses; Any is the old behaviour. Native targets; on wasm32 the host's fetch follows redirects itself.
• MCP stdio, own process group: the group goes when the command exits (asked for by yobuild). With own_process_group, a command that exits on its own (an npx or launcher wrapper) now has its group killed as soon as its exit is seen — by the exit watch (exited(), an McpToolSource turn) or a call finding its output closed — before it is collected, while its id is still safe to signal. Before, a poll that collected it left what it started running for good. A launcher that backgrounds the real server and exits takes that server down with it (yoagent already reports it gone then).