[ruudk]

Closes #644.

A session is optional in the handshake era: a server "MAY assign a session ID at initialization time". The SDK always creates one on initialize and refuses every later request without it, so a horizontally scaled server has to share a session store and lock only to serve handshake-era clients.

Builder::withoutSessions() turns that off for Streamable HTTP:

• initialize is answered without Mcp-Session-Id, and a session id the client sends anyway is ignored;
• every request is served on a session of its own that is dropped once it is answered;
• GET and DELETE are answered with 405, which the spec allows for a server without a stream and for one that does not let clients end sessions.

Requests to the client (elicitation, sampling, roots/list) fail right away in this mode, since the client answers them in a POST of its own that cannot be matched without a session. Progress and other notifications sent during a request still reach the client. The TypeScript SDK serves handshake-era traffic the same way with sessionIdGenerator: undefined.

The option is off by default, so existing servers behave exactly as before. The only API additions are Builder::withoutSessions(), a trailing optional $sessionless argument on Protocol::__construct() and an @internal StreamableHttpTransport::setSessionless(). stdio and the 2026-07-28 era are not affected.