fix(mcp): support mcp/sdk 0.7 and pin symfony/mcp-bundle

[soyuka]

Fixes the full CI blackout on 4.3 (and, after up-merge, 4.4 / main): every job currently dies before vendor/autoload.php exists.

Why CI is red

composer install is unresolvable:

- Root composer.json requires symfony/mcp-bundle dev-main
- symfony/mcp-bundle dev-main requires mcp/sdk ^0.7 -> found mcp/sdk[v0.7.0]
  but it conflicts with your root composer.json require (^0.6).

symfony/mcp-bundle was required as dev-main. Its v0.12.0 release (2026-07-21) moved to mcp/sdk ^0.7, which no longer satisfies our ^0.6 pin. No API Platform commit caused this — it is dependency drift through an unpinned dev branch.

mcp-bundle	mcp/sdk
v0.10.0	^0.6
v0.11.0	^0.6|^0.7
v0.12.0 / dev-main	^0.7

A second, older failure has the same root cause: the Laravel (PHP 8.x) jobs have been red since at least 2026-07-12 with 10 McpTest failures, because McpController::__construct() gained a required MiddlewareFactory argument upstream:

ArgumentCountError: Too few arguments to Symfony\AI\McpBundle\Controller\McpController::__construct(), 5 passed
  at src/Laravel/ApiPlatformProvider.php(1263)

Changes

• mcp/sdk widened to ^0.6 || ^0.7 in the root composer.json and in src/Mcp/composer.json — this part is @jbtronics' work in [MCP] Allow MCP sdk 0.7  #8422.
• symfony/mcp-bundle pinned to ^0.12 (root + src/Laravel) instead of dev-main, so an upstream main release can no longer break the build without a deliberate bump.
• ApiPlatformProvider passes a MiddlewareFactory to McpController. A default-constructed factory returns null from create(), which keeps the SDK's secure defaults (CORS, DNS rebinding protection, protocol version) — same behaviour as the Symfony bundle's default.

Verified locally

Gate	Before	After
composer install (root)	unresolvable	resolves sdk v0.7.0 + bundle v0.12.0
tests/Functional/McpTest.php	blocked	14/14
src/Mcp/Tests	blocked	25/25 (component is sdk 0.7 compatible)
Laravel suite	205 pass / 10 fail	215/215
Laravel PHPStan (larastan)	—	no errors
php-cs-fixer	—	clean

Notes

• Supersedes [MCP] Allow MCP sdk 0.7  #8422, which only widened src/Mcp/composer.json. That alone leaves the root ^0.6 pin in place, so its own CI is still fully red. Opened against 4.3 rather than main because the breakage exists on all three branches and should flow up.
• Follow-up, out of scope here: unlike the Symfony bundle, the Laravel integration exposes no configuration for the SDK's DNS rebinding protection allow-list, so a Laravel MCP server served from a non-localhost host will need a knob wired through config/api-platform.php.