fix(security): bump @modelcontextprotocol/sdk to 1.26.0

Resolves 3 OSV-confirmed GHSAs in @modelcontextprotocol/sdk:
- GHSA-8r9q-7v3j-jr4g (fixed 1.25.2)
- GHSA-w48q-cv73-mx4w (fixed 1.24.0)
- GHSA-345p-7cg4-v4c7 (cross-client data leak via shared server/transport
  instance reuse, fixed 1.26.0)

Post-fix skylos --sca scan: 0 vulnerabilities.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: byteworthy

package-lock.json

@@ -14,7 +14,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0"
+    "@modelcontextprotocol/sdk": "^1.26.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",