feat: add experimental MCP webhook verification and delivery helpers

apps using MCP Events currently need to implement the callback challenge and signed HTTP delivery themselves. this adds two optional helpers that fit the existing registration and storage adapters:

• experimental_verifyMcpWebhookEndpoint sends a signed, single-use consent challenge and returns the existing verification result shape.
• experimental_deliverMcpEvent validates the stored subscription, payload, current permissions and expiry, then sends one Standard Webhooks-signed event. it supports key rotation, stable occurrence timestamps, explicit safe watermarks and categorized retry outcomes.

both require HTTPS, validate resolved addresses at connection time, refuse redirects, and bound request duration and response size. the sender also caps outgoing bodies at 256 KiB. these protections apply in every environment. shared URL/secret validation keeps registration and delivery consistent.

storage, consent caching/rate limits, cancellation coordination, filter matching, control envelopes and durable retries stay with the application. docs include adapter and worker examples. all new APIs are experimental.

validation: 200 tests pass, including 58 new helper tests; typecheck and ESM/CommonJS builds pass. checked both package entry points and TypeScript consumer imports. transport behavior uses deterministic fixtures, with separate real-HTTPS-transport tests for literal-address filtering and repeated DNS validation.