fix(deps): cap the [mcp] extra below 2.0

mcp 2.0.0 removed `mcp.shared.memory.create_connected_server_and_client_session`
and dropped `Server.list_tools`. Our constraint was an unbounded `>=1.2.0`, so
CI resolved to 2.0.0 the day it was published and every `soup mcp serve`
round-trip test failed on all nine jobs — on every OS and Python version, which
is what distinguished an upstream break from a regression in the commit under
test.

Verified 1.29.0 (the newest 1.x) still exposes both APIs before capping, rather
than assuming the boundary. Migrating to the 2.x API is separate work; shipping
against an unvalidated major is not a substitute for it.

CHANGELOG.md

@@ -57,6 +57,10 @@ of it was written.
   tier holds one open shard handle per decoder layer.
 - Subprocess helpers resolve tools to absolute paths (on Windows, `CreateProcess`
   searches the current directory before `PATH`).
+- The `[mcp]` extra is now capped at `mcp<2`. The SDK's 2.0.0 release removed
+  `mcp.shared.memory.create_connected_server_and_client_session` and dropped
+  `Server.list_tools`, breaking `soup mcp serve`'s round-trip tests for anyone
+  installing fresh. Support for the 2.x API is tracked separately.
 
 **Known limitations**
 

pyproject.toml

@@ -105,7 +105,14 @@ modal = ["modal>=0.60.0"]
 # v0.71.28 - `soup mcp serve` MCP server. The official `mcp` python SDK is
 # lazy-imported (only src/soup_cli/mcp_server/server.py touches it), so the CLI
 # stays light without it. Floor pinned to guard against SDK API churn.
-mcp = ["mcp>=1.2.0"]
+#
+# v0.72.3: capped below 2.0. The floor alone was not enough — mcp 2.0.0 removed
+# `mcp.shared.memory.create_connected_server_and_client_session` and dropped
+# `Server.list_tools`, which broke every `soup mcp serve` round-trip test on all
+# nine CI jobs the day it was published. 1.29.0 (the newest 1.x) still exposes
+# both, verified directly. Migrating to the 2.x API is its own piece of work,
+# and shipping against a major nobody has validated is not a substitute for it.
+mcp = ["mcp>=1.2.0,<2"]
 
 [project.scripts]
 soup = "soup_cli.cli:run"