Add json-rpc-batch-rejection scenario for 2025-06-18+

[canardleteer]

Closes #378

Summary

• Adds server scenario json-rpc-batch-rejection with check json-rpc-batch-rejected for spec versions ≥ 2025-06-18, exercising the Streamable HTTP transport MUST that the POST body be a single JSON-RPC message (not a JSON array).
• Probe establishes a stateful session, then POSTs a two-request [ping, ping] batch so rejection is tested on batch handling rather than unrelated session routing errors.
• Adds negative fixture accepts-json-rpc-batch.ts, unit tests for acceptance/rejection helpers, and an early array guard in everything-server so the reference server passes all-scenarios.test.ts (documented in code — negative proof remains in the broken fixture per AGENTS.md).

Test plan

• npm run build
• npm test (338 tests, including all-scenarios.test.ts / json-rpc-batch-rejection)
• npm test -- src/scenarios/server/negative.test.ts (json-rpc-batch-rejected → FAILURE against accepts-json-rpc-batch.ts)
• npm test -- src/scenarios/server/json-rpc-batch-rejection.test.ts
• CLI smoke: node dist/index.js server --url http://127.0.0.1:<port>/mcp --scenario json-rpc-batch-rejection --spec-version 2025-11-25 against everything-server → SUCCESS
• CLI run against typescript-sdk conformance server — node dist/index.js sdk typescript-sdk-v1 --mode server --scenario json-rpc-batch-rejection --spec-version 2025-11-25 → json-rpc-batch-rejected FAILURE (typescript-sdk v1.x accepts batch arrays at 2025-11-25; intentional Tier-1 signal for that spec version until the SDK fixes batch rejection)
• Confirm scenario absent for --spec-version 2025-03-26 — CLI: SKIPPED: … not applicable … (introduced in 2025-06-18), exit 0
• --spec-version draft run against everything-server → json-rpc-batch-rejected SUCCESS (stateless draft batch probe)

Notes for reviewers

• Spec backing: MUST-level requirement from transports prose, not changelog narrative alone. Changelog linked as supporting context.
• Success criteria: HTTP 4xx with a single JSON-RPC error object (not strict -32600) until SDKs converge on error codes.
• Tier-1 impact (2025-06-18+ / draft only): This scenario is gated to spec versions where batch rejection is required; --spec-version 2025-03-26 skips it entirely.
  • Tier-1 conformance is evaluated per target spec version — when an SDK is scored at 2025-06-18+ (or draft) and its server still accepts batch arrays after session setup, it should fail until fixed.
  • SDKs not ready to reject batches yet can stay in good standing by tier-checking at an older --spec-version (or otherwise explicitly opting out of claiming full conformance at 2025-06-18+). The check is active, not pending; the margin is which spec version the SDK holds itself to.
• everything-server change: Reference-server alignment for all-scenarios; failure proof is the separate negative fixture.