Add SEP-2567 (sessionless Streamable HTTP) conformance coverage

[felixweinberger]

SEP-2567 is merged into the draft spec: protocol-level sessions and the Mcp-Session-Id header are removed from Streamable HTTP, and the list endpoints (tools/list, resources/list, prompts/list) are connection-invariant (see the draft changelog).

The suite has no coverage for it yet: there is no src/seps/sep-2567.yaml, and no scenario exercises the sessionless invariants at the draft revision.

We should add requirement traceability and a draft-suite server scenario, following the sep-2575 pattern (sep-2575.yaml + ServerStatelessScenario).

Related: #222 covers the 2025-11-25 "server MAY omit Mcp-Session-Id" path at the dated spec versions; the draft revision removes sessions outright, so that work is complementary.

[felixweinberger]

Closing this. On reflection the wire-observable substance of SEP-2567 is already covered implicitly: every draft-suite scenario sends sessionless requests, so a server that still required Mcp-Session-Id would fail server-stateless and the rest before any dedicated check ran. The parts a dedicated scenario would add on top are either that same redundancy (accepts-without-session-id) or hard to prove over the wire: list connection-invariance is a "server doesn't vary the list" claim that a two-snapshot probe can only sample, with a real false-positive risk against servers whose lists legitimately change over time, and the backward-compat SHOULDs skip for dual-era servers, which is what most real implementations will be during the transition.

If the traceability dashboard needs SEP-2567 to show as accounted for, an exclusion note pointing at the existing sessionless draft scenarios is a better fit than a scenario whose checks are mostly redundant or heuristic.