[jung-thomas]

Closes #2908

Summary

• Bumps @sap/cds + @sap/cds-dk to ^10.2.0 (resolves cds 10.2.2 / cds-dk 10.2.0)
• Bumps @cap-js/* plugins to latest 10.2-compatible: change-tracking 2.2.3, hana 3.1.2, ord 1.10.2, sqlite 3.1.2, telemetry 2.2.0, websocket 1.11.4
• No application code changed — package.json / package-lock.json only (plus a plan doc)
• No CAP 10.2 opt-in feature flags adopted (all deferred with reasons — see below)

Deliberately held back (10.2-compatible as-is; breaking changes are orthogonal to the runtime upgrade)

• @cap-js/ai kept at ~1.1.0 — 1.3.0 adds startup Hugging Face model discovery for the local sqlite embedding kind (all-MiniLM-L6-v2), which hard-fails without @huggingface/hub and downloads on cache-miss environments (CI). Dev/test-only path (prod/hybrid use AICore-btp DB-native VECTOR_EMBEDDING), but still a boot-time network regression. Peer @sap/cds >=9 → 10.2-compatible. Bumping + proper HF pre-provisioning belongs in its own issue.
• @cap-js/mcp kept at 1.3.0 — 1.5.0 refactored lib/tools.js, removing the deep-imported getInstructions / register* symbols that srv/lib/mcp-compose-router.js relies on. Peer @sap/cds >=8 → 10.2-compatible. Adapting the compose router to 1.5.0's new create*ToolDefinition / execute* API belongs in its own issue.
• @cap-js/data-inspector kept at 1.0.5 (2.0.1 is a major bump of a build-model plugin, out of scope).

Opt-in flags deferred

• cds.fiori.draft_admin_integrity / draft_orphan_cleanup — NOT adopted. AdminService has load-bearing before('DELETE') handlers on draft composition entities (CompletionPathItems / GroupPathItems capture parent FK before removal; Tutorials DELETE). The release notes warn the cascade path "changes which handlers are called"; verifying safety needs HANA draft-delete testing. Should land together in a dedicated HANA-tested follow-up.
• @cds.autoexpose: false — additive API-export annotation, no current need.

Breaking changes checked

• @odata.metadataEtag removal and CqnSelect.getTransformations() immutability are CAP Java only — no matches in srv/ or test/ (this is a Node.js project).
• MCP single-call-tool default is correctly overridden by existing cds.mcp.per_action_tool: true.

Note for reviewers

The committed plan doc (docs/superpowers/plans/2026-11-01-cap-10-2-upgrade.md) lists the intended targets (ai ^1.3.0, mcp ^1.5.0, adopt draft flags) that execution deliberately overrode after discovering the breaking changes above. The shipped code is correct; only the plan text reads ahead of reality.

Test plan

• Representative scoped unit slice passes locally (60/60: admin-service, admin-drafts, catalog-data, content-publish-guard, built-csn-plugin-services)
• AI plugin loads without error
• Full unit suite (runs in CI)
• cds watch dev-server smoke (reviewer)