v0.4.14: refresh MCP dependencies and lock the Python environment

Refreshes the MCP stack and locks the Python dependency graph.

- Upgraded the MCP SDK to 1.28.1 and Black to 26.3.1. Runtime and
  development images now install strictly from uv.lock.
- Added a Streamable HTTP MCP contract test that initializes the mounted route,
  lists tools, and calls mailboxes through the application.
- Fixed package update commands for exact pins and the dev group.
- Aligned runtime, package, health example, and Codex plugin versions.