feat: #3618733 Forward Tool API metadata for MCP Apps

The bridge currently drops Tool API definition and execution-result metadata. MCP Apps tools therefore cannot advertise a UI resource through the bridge or send presentation data separately from their typed outputs.

This MR forwards the mcp entry from Tool API definition metadata into MCP tool definitions and from formatted execution results into the SDK's CallToolResult::meta, serialized as _meta. Other consumers' metadata is excluded, and empty MCP metadata is omitted. This supports UI resource declarations such as _meta.ui.resourceUri and custom result metadata.

Successful and failed execution results preserve MCP metadata. Bridge-generated errors, including access denials, carry none. Metadata stays separate from structuredContent and text blocks; existing output formatting, hints, input-schema feedback, and access checks retain their behavior.

Dependencies — required before merge

This consumes the metadata APIs introduced by MCP Server !89 and Tool API !206. Both MRs are still open. Hold this MR until both are merged and tagged, then raise the Composer minimum versions to the first releases containing those APIs. The currently permitted releases cannot run this implementation.

Commit 761b27b temporarily pointed CI at the two reviewed issue forks to validate this integration. Commit dba9467 reverts those overrides; the final CI configuration is unchanged. The validation pipeline and job logs remain linked below. Both current-major and previous-major checks can fail again until the Composer minimum versions are raised to releases containing the metadata APIs.

MCP Server owns extension registration and UI resources; Tool API owns the generic metadata contract. This MR connects them through the existing bridge. App rendering remains the host's responsibility.

Testing

The existing wire suite now checks definition and result metadata, exclusion of other consumer namespaces, failed execution metadata, omission for ordinary successful calls and access denials, and separation from structured/textual outputs. Both bridge behavior documents describe this contract.

• Full bridge suite in DDEV against the reviewed dependency forks with PHP MCP SDK 0.8.1: 38 tests, 628 assertions pass.
• PHPCS (Drupal and DrupalPractice) and git diff --check pass.
• PHPStan at level 3 reports four existing config-entity method errors, reproduced on the unchanged branch; no additional errors were introduced.

Fork-backed CI evidence

Pipeline 992436 ran commit 761b27b with only temporary CI dependency overrides, pinning Tool !206 at 2b7013d and MCP Server !89 at 6d82bff.

• Current-major PHPUnit: all 38 tests pass, including the three wire tests.
• Previous-major PHPUnit: all 38 tests pass, including the three wire tests.
• Current-major PHPStan: passes with no errors.
• Previous-major PHPStan: still fails on 13 pre-existing missing Drupal/PHPUnit attribute-class errors; the metadata API errors are gone. Those attributes were already present before this MR.
• Composer, PHPCS, Composer lint, ESLint, and CSpell jobs pass.

The pipeline as a whole is not green because of that remaining previous-major PHPStan failure. These passing jobs provide CI evidence for the metadata changes, separate from the local PHPStan check above. The temporary issue-fork overrides have been reverted and are absent from the final merge diff.

AI disclosure

AI-Generated: Yes. OpenAI Codex generated portions of the implementation and tests and drafted this MR description under human guidance.

Closes #3618733