fix: resolve cargo audit vulnerabilities (rmcp 1.x migration)

[geoffjay]

Summary

cargo audit was failing with 5 vulnerabilities. This resolves all of them by upgrading the affected crates — no new advisory suppressions were added to .cargo/audit.toml.

Advisory	Crate	Fix
RUSTSEC-2026-0204	crossbeam-epoch 0.9.18 → 0.9.21	cargo update (transitive)
RUSTSEC-2026-0258	h2 0.4.13 → 0.4.19	cargo update (transitive)
RUSTSEC-2026-0185	quinn-proto 0.11.14 → 0.11.17	cargo update (transitive)
RUSTSEC-2026-0235	rkyv 0.7.46 → removed	pin rust_decimal to 1.43.0, which drops rkyv
RUSTSEC-2026-0189 (8.8 high)	rmcp 0.1.5 → 1.8.0	direct dep upgrade + code migration

rust_decimal 1.43.0 drops its rkyv dependency, so rkyv, bytecheck, rend, ptr_meta and seahash are removed from Cargo.lock entirely.

rmcp 0.1 → 1.8 migration (crates/mcp)

rmcp 1.x replaced the old macro/handler model, so crates/mcp/src/server.rs was migrated:

• #[tool(tool_box)] → #[tool_router] on the tools impl; #[tool_handler] on the ServerHandler impl.
• The per-argument #[tool(param)] + #[schemars(description)] style is gone. Each of the 50 parameterised tools now takes a Parameters<Args> extractor backed by a dedicated #[derive(Deserialize, JsonSchema)] struct; field docs carry over as doc comments, so the JSON Schemas exposed to MCP clients are unchanged (59 tools total, same required lists and field types).
• ServerInfo is #[non_exhaustive] in 1.x; get_info now uses ServerInfo::new(capabilities).with_instructions(...).
• schemars dependency 0.8 → 1, matching rmcp 1.8's schema pipeline.

Note: RUSTSEC-2026-0189 is a DNS-rebinding issue in rmcp's Streamable HTTP server transport; this crate only uses the stdio transport, but the upgrade clears the advisory regardless.

Verification

• cargo audit exits 0 — no vulnerabilities (only the pre-existing allowed warnings remain).
• cargo build --workspace clean; cargo clippy -p agentd-mcp clean; cargo fmt --check clean.
• cargo test -p agentd-mcp -p agentd-common: 184 passed, 0 failed.
• Live stdio smoke test against the release binary: initialize handshake (protocol 2025-06-18) advertises the tools capability and instructions, tools/list returns all 59 tools with correct schemas, tools/call executes and degrades gracefully when backing services are down, and a missing required argument returns an in-band isError result naming the missing field.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.14%. Comparing base (7a644c2) to head (4a3d601).

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #1332       +/-   ##
===========================================
+ Coverage   49.19%   69.14%   +19.95%     
===========================================
  Files         468      220      -248     
  Lines       31606     8998    -22608     
  Branches     3121     3171       +50     
===========================================
- Hits        15547     6222     -9325     
+ Misses      16027     2744    -13283     
  Partials       32       32               

Flag	Coverage Δ
frontend	69.14% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.