## Description The mcp_server module currently requires "mcp/sdk": "dev-main" in its composer.json. This was a temporary measure (introduced in issue #3585886, "require mcp/sdk dev-main, drop bundled patch") taken because the upstream changes the module relies on — notably the runtime-resolved element handlers from modelcontextprotocol/php-sdk PR #294 — had not yet shipped in a tagged release. mcp/sdk v0.6.0 was tagged on 2026-06-02 and includes those changes, so the module should now pin to the stable "^0.6" constraint instead of tracking the unstable dev-main branch. Depending on dev-main forces consumers to relax minimum-stability and exposes them to unreviewed upstream changes; a tagged constraint restores reproducible, stable installs. ## Acceptance Criteria - [ ] The module composer.json requires "mcp/sdk": "^0.6" instead of "dev-main". - [ ] composer.lock resolves mcp/sdk to a v0.6.x tagged release. - [ ] No dev-main reference or relaxed minimum-stability remains on account of mcp/sdk. - [ ] The module test suite passes against mcp/sdk ^0.6. ## Additional Context The dev-main constraint was introduced by commit f1656bd ("build: #3585886 require mcp/sdk dev-main, drop bundled patch"). mcp/sdk v0.6.0 was released on 2026-06-02 (upstream: https://github.com/modelcontextprotocol/php-sdk). The companion development site already updated its root constraint to ^0.6 and dropped the bundled mcp-sdk-runtime-handlers.patch in commit 96dc919.