Validate JSON-RPC method wire values

[leehack]

Summary

• reject JSON-RPC request and notification envelopes whose method is not a string
• validate generic JSON-RPC request params with JSON-object parsing instead of a Dart cast
• add unit and CLI conformance coverage for malformed method envelopes
• update the unreleased MCP 2026 RC changelog

Validation

• dart format .
• dart analyze
• git diff --check
• dart test test/types_edge_cases_test.dart
• (cd packages/mcp_dart_cli && dart test test/src/conformance_command_test.dart && dart run mcp_dart_cli:mcp_dart conformance --suite all --json)
• dart test

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.43%. Comparing base (eb37424) to head (e7cdefd).

Additional details and impacted files

@@                             Coverage Diff                              @@
##           spec/json-rpc-response-exclusive-members     #239      +/-   ##
============================================================================
- Coverage                                     88.43%   88.43%   -0.01%     
============================================================================
  Files                                            47       47              
  Lines                                          9314     9319       +5     
============================================================================
+ Hits                                           8237     8241       +4     
- Misses                                         1077     1078       +1     

Flag	Coverage Δ
unittests	88.43% <100.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[leehack]

Closing this draft micro PR because the RC spec work has been consolidated into a smaller reviewable stack. This change is preserved in #270 (JSON-RPC metadata hardening); the consolidated tip is tree-identical to the previous micro-stack tip.