everything: Streamable HTTP answers 400 instead of 404 for an unknown or terminated session #4982

Problem

For a request carrying an Mcp-Session-Id that the server does not know, or that was ended with DELETE, transports/streamableHttp.ts answers 400 Bad Request. The spec (2025-11-25, Streamable HTTP, Session Management) says the server MUST respond 404 Not Found, which is the signal for a client to start a new session. The 400 body for a POST also omits the JSON-RPC request id.

Where it is pinned

src/everything/__tests__/streamable-http.test.ts: "answers %s for an unknown session with a 400" (GET, DELETE), "answers a POST for an unknown session with a 400 that omits the request id", "ends a session on DELETE, cleaning it up and refusing it afterwards", added in #4978 (Wave 1 of #4857). Each of these tests carries a KNOWN BUG marker: it asserts the current, wrong behavior, so the fix has to change it.

Expected

404 for an unknown or terminated session ID, and the error object carries the request's id when the request had one.

Done when

• The behavior above is fixed, in the legacy-era (2025-11-25) server on SDK 1.x.
• The pinning tests assert the correct behavior, and their KNOWN BUG markers are gone.
• The per-file 90% coverage gate still passes.