docs(subscriptions): clarify ResourceUpdated works with any handler s…

…hape (#8)

Both READMEs now state explicitly that the SDK's
resourceSubscriptions map is maintained independently of the
user-supplied SubscribeHandler / UnsubscribeHandler:

- subscribe: the handler runs as a gate (err = reject,
  nil = allow). On allow, the SDK unconditionally adds the session.
- ResourceUpdated: reads from the same map and fans out, regardless
  of handler type.

So 'no-op handlers + ResourceUpdated' (Pattern A) and 'custom
handlers + ResourceUpdated' (Pattern B) use the same fan-out
primitive. The handler type only decides which URIs are accepted
and what extra lifecycle work runs on subscribe/unsubscribe, not
whether notifications reach subscribed sessions.

Verified against go-sdk v1.5.0/mcp/server.go:
  - ResourceUpdated reads s.resourceSubscriptions[params.URI].
  - subscribe populates s.resourceSubscriptions after a successful
    user handler call.
  - unsubscribe removes from the same map after a successful user
    handler call.

feat: use v1.5.0 mcp go-sdk

Signed-off-by: Soumya Ghosh Dastidar <gdsoumya@gmail.com>

chore(ci): GitHub Actions workflow + issue and PR templates

.github/workflows/ci.yml — three jobs run on push to main/master
and on every PR:

- test: Go 1.26.2 matrix, verifies go.mod is tidy,
  `go build ./...` + `go test -race -count=1 -covermode=atomic`
  with coverage upload.
- lint: golangci-lint v2.11.4 via golangci/golangci-lint-action
  (pinned to its commit SHA), honoring the repo .golangci.yml.
- proto: buf lint, buf breaking against the base branch on PRs
  (soft-fail), plus a codegen-staleness check — the job installs
  protoc-gen-go, protoc-gen-go-grpc, and the repo's own
  protoc-gen-mcp, runs `buf generate`, then
  `git diff --exit-code`, so any unchecked-in generated output
  fails the build.

Supply-chain hygiene:

- Every third-party action is pinned to a full 40-char commit
  SHA with a trailing `# vN` comment. A moving tag can be
  force-updated by the action maintainer to run arbitrary code
  with whatever secrets the workflow carries; a pinned SHA is
  immutable. Dependabot's action-version updater reads the tag
  comment to know what version stream to watch, so the comments
  are not cosmetic.
- Runtime-provided variables that flow into shell commands
  (github.base_ref, github.repository) are pulled into env:
  blocks rather than interpolated directly, per GitHub's
  injection-hardening guidance.
- Single workflow-level env.GO_VERSION is the only place the Go
  toolchain version lives. Keeps lint / proto jobs in lockstep
  with the test matrix and with go.mod.

.github/ISSUE_TEMPLATE/ — structured form-based issue templates:

- config.yml disables blank issues, routes security reports to
  the GHSA private-reporting flow, and routes generic questions
  to Discussions.
- bug_report.yml captures the repro, the relevant versions
  (go / protomcp / go-sdk / buf), the generated output or error,
  plus a pre-flight "searched existing issues" checkbox.
- feature_request.yml frames proposals around a concrete user
  problem + proposed shape, explicitly references the design
  principles in CONTRIBUTING.md so contributors understand the
  non-negotiable rules before drafting.

.github/pull_request_template.md — summary, type of change, test
plan, and a design-principles checklist that mirrors the seven
non-negotiable rules in CONTRIBUTING / AGENTS. Reviewers and
agents share one yardstick.