[V2 Debt] Strict-init lifecycle lock + pinned ext-apps baseline (#26)

[dukefromearth]

Summary

• pins workspace @modelcontextprotocol/ext-apps dependency to exact 1.1.2 to prevent unreviewed semver drift while upstream strict-init fix is unresolved
• adds upstream-tracking repro + blocker documentation at docs/upstream-ext-apps-strict-init-reproducer.md
• strengthens canonical real-MCP lifecycle integration test to assert no duplicate host app_initialized evidence for a mounted instance
• updates docs index and real-MCP testing guide to reflect strict lifecycle regression lock

Why

Issue #26 identified an upstream strict-mode init/idempotency dependency gap. Upstream references now exist and are active:

• PostMessageTransport: Race condition with srcdoc iframes — host misses ui/initialize modelcontextprotocol/ext-apps#542
• feat: support deferred target in PostMessageTransport for dynamically created iframes modelcontextprotocol/ext-apps#543

Until upstream merge + release happens, this repo still needs deterministic local protection:

• hard pin to known-good ext-apps version
• contract lock test that rejects duplicate lifecycle progression
• explicit blocker ownership + next check date

Verification

• npm run verify
• npm run test:integration:real-mcp

Blocker Status

• External blocker remains: upstream issue/PR open as of 2026-03-08.
• This PR lands all local actionable work and documents owner/date/next action.

Refs #26