Export MCP notification-method constants and converge call sites

Context

A library-reuse review of #5934 found that MCP notification/request method-name wire strings are hardcoded in several places because no shared, exported source defines them:

• pkg/transport/proxy/streamable/dispatcher.go — #5934 collected them into a local const block (notifications/tools/list_changed, notifications/resources/list_changed, notifications/prompts/list_changed, notifications/progress, notifications/resources/updated, notifications/message, resources/subscribe, resources/unsubscribe).
• pkg/mcp/parser.go — hardcodes the same strings as (unexported) map keys for request parsing.
• pkg/vmcp/forwarding.go — declares its own MethodProgressNotification / MethodLogNotification constants.

toolhive-core/mcpcompat/mcp already exports some method/level constants (e.g. MethodSetLogLevel, LoggingLevel* — now reused in #5934), and the go-sdk defines the notification methods but only unexported, so they aren't reusable today.

Proposed work

• Upstream the missing MCP notification/request method-name constants into toolhive-core/mcpcompat/mcp (the shared low-level package this repo already depends on), or export them from pkg/mcp if that's the more appropriate home.
• Converge the call sites (streamable proxy local block, pkg/mcp/parser.go map keys, pkg/vmcp constants) onto the single exported source so the wire strings are defined once.

Notes

• Avoid the wrong dependency direction: transport/pkg/mcp must not import pkg/vmcp. A shared home in toolhive-core/mcpcompat or pkg/mcp keeps layering correct.
• Confirmed as a follow-up (not a blocker) by the #5934 review panel.

Generated with Claude Code

Start by inspecting the existing exported constants in toolhive-core/mcpcompat/mcp, then compare the method strings and constants in pkg/transport/proxy/streamable/dispatcher.go, pkg/mcp/parser.go, and pkg/vmcp/forwarding.go. Check the relevant Go package tests before and after the change. Done means the listed wire strings have one exported source and the call sites use it without reversing the package dependency direction.