chore(release): prepare MCP 1.0.16

[escott-]

Bumps the workspace, npm package, MCP Registry metadata, and the boundary self-test to 1.0.16, and adds the 1.0.16 changelog covering the one commit on main since v1.0.15:

• 09d19cd init prints the session id and the resume call to make, and resume / resume_list note when no id was passed. The hosted gateway keeps no state between calls for clients on the stateless 2026-07-28 contract (Claude Code 2.1.289), so the id init stored (the 1.0.15 approach) did not exist when resume ran. The resume_id parameter text changes too.

No dependency changes: Cargo.lock differs from 1.0.15 only in the seven workspace package versions.

Verification

On ovh-desktop, against main 09d19cd plus this change:

• cargo fmt --all --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace --all-targets: 2963 passed, 0 failed (2961 before, plus the commit's 2 new tests)
• account_connection_smoke.py against the built binary: 9 tests
• cargo audit --deny warnings and cargo deny --locked check: clean

On a clean copy of the tracked files: public_boundary.py, release_contract.py resolve-version for v1.0.16, the release-contract, boundary, DCO, workflow, grounding and adoption script tests, and npm test (6/6).

Before this PR I reproduced the reported behavior on the published 1.0.15 binary by driving its real HTTP server as a stateless client and as a legacy initialize-era client against a mock API: statelessly, init prints no id and resume sends no exclude_session_id; on the legacy path state persists and the id is excluded. The same check will be run on the 1.0.16 binary before it is published.

Not verified: the fix on the hosted gateway with a real stateless client. That needs a release and a fresh Claude Code session: init, then session(action="resume", session_id="<id init printed>") must return the previous session.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}