build: update mcp requirement from <2,>=1.27 to >=1.27,<3 in the python group - #33

Every test in this module called build_server().list_tools() in-process,
which exercises registration and not the protocol. A server that builds
its tools correctly and cannot answer `initialize` passed all of them.
That is not hypothetical: a corrupted copy of the mcp package produced
exactly that state during this port -- suite green, server unable to talk
to the SDK's own client -- and no test noticed. One now starts
netspec-mcp as a process and completes the handshake.

The budget assertion was a ceiling and a floor, and a payload that drops
only inputSchema measures ~713 tokens, which sits comfortably between
them. Reverting to a hand-built payload was green the same way. It now
asserts the measured bytes equal the serialised tool list, so the budget
cannot measure a subset of the wire and call it the wire.

D7 stated the mcp pin as >=1.27,<2, which this branch falsifies; it now
names D27 as superseding it in part, and D27 records the port -- why
>=1.27,<3 is wrong, and that list_tools being async and inputSchema
becoming input_schema cost more than the rename the release advertised.

The tool budget was published as ~834 tokens in the README and in
DECISIONS. It measures 999. The figure was stale across two changes to
what it measured, so both sites now name tool_schema_size() as the
source and state the ceiling rather than carrying a number by hand.

Refs #33

… number

The budget figure was republished as "under 1,000 tokens" after ~834 went
stale. It measures 999, nothing asserts the bound, and four characters
added to one tool docstring makes it 1000 and both published sites
false with the suite green. D27 two entries below says the figure is
produced and never typed; the sentence contradicting it was mine.

Neither site now carries a number. Both name tool_schema_size() as the
source and the 3,000 ceiling CI actually asserts.

The handshake test had the protocol's own bytes in hand and only checked
for a key. Both sides of the budget's equality assertion are the same
model_dump, so a divergence between that rendering and what the server
sends would pass; the handshake now compares the budget's byte count
against what came back through the protocol. Length rather than the
string, because a JSON round-trip may reorder keys inside a schema
without changing what it costs.

The handshake test also skipped where the entry point is missing, which
is right for a contributor without the extra and wrong for CI -- the
same reasoning the module-level import already applies.

Refs #33

approx_tokens is bytes // 4, so a measured 3,998 crosses 1,000 tokens at
4,000 and not at 4,002. The four came from 1000 - 999 = 1 token times
four bytes, which is the arithmetic that looks right rather than the one
that is -- substituted in the sentence arguing against substituting
plausible numbers for measured ones, under a subject line arguing
against it. Corrected to two, with the derivation written down.

"No number is written here" was also false of its own paragraph, which
carries four survey figures. Those are someone else's measurements and
do not move; what the entry means is no measured figure for netspec's
own surface, and it now says that.

Refs #33