Enforce MCP initialization phases and server capabilities

[Widthdom]

Summary

• enforce explicit MCP session phases and reject duplicate initialize requests without replacing accepted session state
• advertise only server-provided capabilities and negotiate client roots after notifications/initialized only for supported clients/protocols
• coalesce and drain the handshake roots refresh, retain late stdio writer resources through bounded teardown, and release late initialization claims safely
• add transcript, concurrency, teardown, audit, bilingual documentation, and changelog coverage

Validation

• dotnet restore CodeIndex.sln
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false --no-restore
• net8 MCP suite: 1,129 passed
• Issue Enforce MCP initialization phases and advertise only server capabilities #4848 regressions: 12 passed on net8.0 and 12 passed on net9.0
• dotnet format CodeIndex.sln --verify-no-changes --no-restore
• dotnet run --project tools/CodeIndex.Changelog -- check
• git diff --check origin/main..HEAD
• Codex adversarial review: two rounds; all actionable P1/P2 findings addressed
• Full-suite runs were attempted; unrelated load-sensitive failures are tracked by Stabilize net9 UTF-8 symbol-worker test under parallel full-suite load #4937 and Stabilize startup-handoff watch test under parallel full-suite load #4939

Documentation and changelog

• Updated the English and Japanese MCP lifecycle/testing guidance.
• Added changelog.d/unreleased/4848.fixed.md.

Follow-up

• Stabilize net9 UTF-8 symbol-worker test under parallel full-suite load #4937
• Stabilize startup-handoff watch test under parallel full-suite load #4939

Fixes #4848