chore(deps): upgrade the MCP Apps extension SDK to 2.0.0

[github-actions]

A new MCP Apps extension SDK release is out. What is installed on v2/main is behind what the npm registry publishes.

Package	Declared	Installed on v2/main	Latest on npm	Behind
@modelcontextprotocol/ext-apps	^1.7.4	1.7.5	2.0.0	yes

Release notes: https://github.com/modelcontextprotocol/ext-apps/releases

Why this is an issue and not a PR

Filed by the nightly SDK watch (#1063), the third of this repo's issue-filing sweeps alongside the monthly dependency refresh (#2229) and the daily Dependabot alert sweep (#2233). None of them opens a PR: a bot-authored PR carries no Closes #N and no board card, so the work would be invisible to the board. A maintainer picks this up and opens a normal PR against v2/main.

Upgrade checklist

• Bump the version(s) in the repo-root package.json — every runtime dependency core/ imports is declared in the repo-root package.json and nowhere else (Dependency placement). The four typescript-sdk packages are pinned exactly, so they move together.
• npm install at the root, and commit the refreshed lockfile.
• Re-check the bundler external lists (clients/{cli,tui}/tsup.config.ts, clients/web/tsup.runner.config.ts) if the release adds or renames an entry point; npm run verify:bundle-externals enforces this against the built output.
• npm run format, then npm run local:gate.

An automated review of what actually changed upstream — and which parts of this app it touches — is posted as a comment below.

A later run of this sweep will not refile this issue. A further SDK release files its own issue and leaves a supersession note here rather than editing this one.