fix(sdk): honor manifest python command, ABI-validate before spawn

[mgoldsborough]

Closes #90.

Summary

• Replace the silent python → python3 rewrite with a single ABI-validated probe. Resolution order: MPAK_PYTHON env override → mcp_config.command from the manifest → literal python3.
• Walk deps/**/*.{so,pyd,dylib} to extract the cpython ABI tag; probe the chosen interpreter once via sys.implementation.cache_tag and require it to match. abi3 wheels read the floor from the extension filename and accept any cpython ≥ floor.
• Cross-check compatibility.runtimes.python (semver) when declared.
• Failure path emits an actionable message — including how to set MPAK_PYTHON or install the right interpreter — instead of letting the bundle crash mid-import with ModuleNotFoundError: No module named 'rpds.rpds'.
• Log the resolved interpreter to stderr at startup: [mpak] using python = /Users/.../python (3.13.5) — removes "what's it actually running?" entirely.

Plus two adjacent fixes the same investigation surfaced:

type: uv resolver gaps

• Probe uv --version first; throw with platform-specific install commands when missing instead of crashing mid-spawn with raw ENOENT.
• Default args for type: uv now match the upstream examples/hello-world-uv shape exactly: ["run", "--directory", cacheDir, entry_point] — CWD-independent. The previous default only worked because the CLI happened to set cwd: cacheDir; embedders that don't honor server.cwd couldn't find pyproject.toml.
• Log resolved uv version to stderr, mirroring the python resolver.

Schema alignment with MCPB v0.4

• Add compatibility block (runtimes.python, runtimes.node, platforms, plus catchall for client version constraints).
• Make mcp_config optional on ManifestServerSchema — MCPB v0.4 lets type: "uv" bundles omit it for host-managed execution.
• Make mcp_config.command and mcp_config.args optional within McpConfigSchema; resolver supplies sensible defaults per server type.
• Surfaces compatibility.runtimes.python to the resolver and unblocks parsing of spec-compliant uv bundles.
• 16 new schema tests including the verbatim hello-world-uv manifest from the MCPB spec, pinning conformance.

Test plan

• pnpm typecheck — green
• pnpm lint — green
• pnpm test — green
  • @nimblebrain/mpak-schemas: 115 tests (was 99 — +16 manifest cases)
  • @nimblebrain/mpak-sdk: 277 tests (was 244 — +33: 18 python-resolver, 5 uv-resolver, 10 mpak end-to-end)
  • @nimblebrain/mpak-registry: 130 tests (unchanged)
  • @nimblebrain/mpak-web: 61 tests (unchanged)
  • @nimblebrain/mpak: 174 tests (unchanged)

Repro from the issue

1. Have any Python ≠ 3.13 on PATH as python3 (e.g. macOS system /usr/bin/python3 is 3.9; Homebrew is 3.11).
2. uv python install 3.13 --default --preview — installs 3.13 and creates ~/.local/bin/python but not python3.
3. mpak bundle run @nimblebraininc/synapse-todo-board

Before this PR: ModuleNotFoundError: No module named 'rpds.rpds' deep in an import chain. ~2 hours to debug to root cause.

After this PR:

Bundle requires cpython-313 (Python 3.13.x), but $(which python3) is cpython-311.
Install with: uv python install 3.13 --default
(or set MPAK_PYTHON to override.)

Rebased

Rebased onto current main (which includes the just-merged #100). One conflict in packages/schemas/src/manifest.ts + tests/manifest.test.ts — kept main's SafeRelativePathSchema security check on entry_point and adopted this branch's optional-mcp_config change for v0.4 compliance. Both test suites union'd cleanly.