DI-5377 Restore stateless MCP HTTP responses in SDK fork

[wiggzz]

Why

The ACA upgrade to dbt-mcp 2.5.0 uses our MCP SDK 1.30 fork. That fork retained stateless task cleanup but dropped two HTTP behaviors from the previous fork: GET/DELETE rejection in stateless mode and graceful handling of a client disconnect during POST body upload. ACA currently restores them with an app wrapper.

What

• Restore both behaviors in the SDK transport. Stateless GET/DELETE returns JSON-RPC 405 with Allow: POST before reading a body or creating a transport. A client disconnect during POST body upload gets the prior 499 ASGI response.
• Keep the stateless shutdown regression on a valid POST response stream.
• Constrain cryptography to the 49 series on Python 3.10. The highest-resolution CI jobs otherwise select 50.0.2, which has no installable Python 3.10 artifact; lowest-resolution jobs otherwise select 0.1, which cannot build on current runners. Other supported Python versions keep their existing dependency range.

The private Git tag v1.30.0+dbt.4 points to this PR's head and builds source and wheel distributions reporting 1.30.0+dbt.4.

Refs

• DI-5377
• ACA upgrade PR
• SDK 1.30 fork PR
• Upstream stateless 405 proposal
• Upstream client disconnect issue

Validation

SDK's full test suite passed with two workers and 100% coverage. Local dry runs of the highest and lowest dependency-resolution modes select cryptography 49.0.0. The default auto-worker local run hit unrelated process-startup timeouts, which did not recur with two workers.

Drafted by GPT-6 under the direction of @wiggzz.