Wire-schema validation does not see raw-HTTP / inline-mock scenario traffic

[pcarleton]

#399 validates every JSON-RPC message that flows through the shared choke points (the SDK transport hooks and the version-aware mock server). Traffic that bypasses those choke points is never schema-checked, and the bypass surface is wider than the note in the PR body (which only mentions the client-auth express mock).

Known uninstrumented paths:

Client scenarios with hand-rolled inline HTTP mocks (requests from the client under test are not validated):

• src/scenarios/client/initialize.ts — the client's initialize request is never schema-checked
• src/scenarios/client/sse-retry.ts
• src/scenarios/client/elicitation-defaults.ts
• src/scenarios/client/http-base.ts and its subclasses (request-metadata.ts, mrtr-client.ts, json-schema-ref-deref.ts)
• the client-auth scenarios' express mock (already disclosed in Validate all wire messages against the per-version spec JSON schema #399)

Server scenarios using raw fetch or their own SDK Client (messages to/from the server under test are not validated):

• src/scenarios/server/sse-polling.ts and sse-multiple-streams.ts — both build their own uninstrumented Client
• src/scenarios/server/http-standard-headers.ts, lifecycle.ts, stateless.ts — raw fetch calls

Observable at the CLI: running the core client suite against the typescript-sdk everything-client, only tools_call reports a wire-schema-valid check; initialize, sse-retry, and every auth scenario record no wire traffic at all.

Related cleanup while touching these files: four client-scenario inline mocks still emit the pre-#3002 top-level serverInfo on draft server/discover responses instead of _meta['io.modelcontextprotocol/serverInfo'] (request-metadata.ts, mrtr-client.ts, json-schema-ref-deref.ts, http-base.ts — src/mock-server/stateless.ts was already fixed in #403).

Suggested direction: route inline client-scenario mocks through the shared version-aware mock server where feasible, and add a small validated-fetch helper for the raw-HTTP server scenarios so intentional protocol violations can opt out explicitly.

[pcarleton]

One more site for the inventory, from the review pass: src/scenarios/server/dns-rebinding.ts sends raw-HTTP probe requests whose responses bypass validation — 16th uninstrumented site.