ci(dependabot): ignore major-version bumps of mcp

.github/dependabot.yml

@@ -15,4 +15,12 @@ updates:
     groups:
       python:
         patterns:
-          - "*"
+          - "*"
+    ignore:
+      # The `mcp<2` cap in pyproject.toml does not hold on its own: dependabot rewrites the
+      # constraint it finds (it proposed `mcp>=2.0.0,<3`) rather than staying inside it. Only
+      # an ignore condition keeps 2.x out of the weekly group. SDK 2.0 removes
+      # `mcp.server.fastmcp` entirely, so the adapter does not import under it — the port is a
+      # deliberate PR, not a dependency bump. Drop this entry when that migration lands.
+      - dependency-name: "mcp"
+        update-types: ["version-update:semver-major"]

pyproject.toml

@@ -23,6 +23,8 @@ dependencies = [
     # Capped below 2.0: that release removes `mcp.server.fastmcp` entirely (FastMCP ->
     # MCPServer) and moves transport config off the constructor, so the adapter does not
     # import under it. Migration is a deliberate PR, not a dependency bump.
+    # The cap alone does not hold the line — dependabot rewrites it. The matching ignore
+    # condition in .github/dependabot.yml is what actually keeps 2.x out; change both together.
     "mcp>=1.28.1,<2",
 ]