Tighten MCP parameter header names

[leehack]

Summary

• add a shared RFC 9110 field-name token validator for MCP parameter header suffixes
• use it for x-mcp-header filtering, server header mapping sync, and Streamable HTTP Mcp-Param-* request validation
• add regression coverage for allowed token characters and rejected separator/control/non-ASCII suffixes

Spec references

• https://modelcontextprotocol.io/specification/draft/server/tools#x-mcp-header
• https://modelcontextprotocol.io/specification/draft/basic/transports#custom-headers-from-tool-parameters

Validation

• dart format .
• dart analyze
• dart test test/shared/mcp_header_validation_test.dart test/client/client_tool_validation_test.dart test/server/mcp_server_test.dart test/server/streamable_https_test.dart
• dart test
• dart pub global run coverage:test_with_coverage
• git diff --check
• git diff --cached --check

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.42%. Comparing base (3ad4e83) to head (ced1018).

Additional details and impacted files

@@                              Coverage Diff                               @@
##           spec/2026-streamable-http-response-headers     #202      +/-   ##
==============================================================================
+ Coverage                                       87.39%   87.42%   +0.03%     
==============================================================================
  Files                                              46       47       +1     
  Lines                                            8686     8703      +17     
==============================================================================
+ Hits                                             7591     7609      +18     
+ Misses                                           1095     1094       -1     

Flag	Coverage Δ
unittests	87.42% <100.00%> (+0.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[leehack]

Closing this draft micro PR because the RC spec work has been consolidated into a smaller reviewable stack. This change is preserved in #268 (MCP 2026 transport enforcement); the consolidated tip is tree-identical to the previous micro-stack tip.