Associate server-to-client requests with the originating client request per SEP-2260

[koic]

Motivation and Context

SEP-2260 (modelcontextprotocol/modelcontextprotocol#2260, merged for the 2026-07-28 spec release) requires servers to send roots/list, sampling/createMessage, and elicitation/create only in association with an originating client request (ping is exempt); standalone server-initiated requests on independent streams must not be implemented. On the Streamable HTTP transport, an associated request rides the originating POST's SSE response stream instead of the standalone GET stream.

The Ruby SDK's ServerContext already satisfies the requirement for handler-scoped calls: list_roots, create_sampling_message, create_form_elicitation, and create_url_elicitation stamp the originating request id as related_request_id, and because the literal keyword appears after **kwargs, a caller-supplied related_request_id: is overridden. That behavior was previously untested and undocumented. This change pins it down and adds a migration signal for direct ServerSession calls, mirroring the TypeScript SDK's approach (typescript-sdk#2228, non-overridable relatedRequestId stamping on ctx-scoped requests):

• ServerContext documents the non-overridable stamping, and new tests lock it in for all four request helpers.
• ServerSession#list_roots, #create_sampling_message, #create_form_elicitation, and #create_url_elicitation emit a deprecation warning when called without related_request_id: (the call still goes out unchanged, on the GET stream for Streamable HTTP). ServerSession#ping is exempt per the SEP. Hard enforcement is deferred to a future protocol-version gate for 2026-07-28.
• A new transport test verifies that send_request with related_request_id delivers on the originating POST stream and never falls back to the GET stream.

Resolves #381.

How Has This Been Tested?

• test/mcp/server_context_test.rb: list_roots stamps the originating request id; create_sampling_message, create_form_elicitation, and create_url_elicitation stamp it non-overridably (a caller-supplied related_request_id: "attacker" is replaced).
• test/mcp/server_roots_test.rb, test/mcp/server_sampling_test.rb, test/mcp/server_elicitation_test.rb: each ServerSession method warns (matching /SEP-2260/) without related_request_id: and stays silent with it. The warning assertions temporarily set $VERBOSE = false because the rake test task runs with -W0, following the existing assert_implicit_connect_deprecation_warning precedent.
• test/mcp/server/transports/streamable_http_transport_test.rb: a roots/list request with related_request_id is written to the registered POST request stream and not to the GET SSE stream.
• Existing direct-call test sites were updated to pass related_request_id: (or capture the warning) so the suite output stays clean; their assertions are unchanged.

Breaking Changes

None. Behavior is unchanged; direct ServerSession calls without related_request_id: now emit a deprecation warning but are still sent exactly as before.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed