…aise mcp floor past PYSEC-2026-3483

- authplane-sdk: issuer identifiers are stored and compared byte-for-byte
  (RFC 9068 iss, RFC 8414 §3.3) — no trailing-slash stripping on storage
  or comparison; query- or fragment-bearing issuers are rejected at
  AuthplaneClient.create() (RFC 8414 §2). Well-known derivation still
  strips the terminating slash (RFC 8414/9728 §3.1); build_prm_url keeps
  the resource query and rejects fragment-bearing resources (RFC 8707 §2).
- authplane-mcp, authplane-fastmcp: the served Protected Resource
  Metadata advertises the configured issuer and resource byte-for-byte
  instead of the AnyHttpUrl-normalised form (RFC 8414/9728 §3.3).
- authplane-mcp: mcp floor raised to >=1.28.1,<2 (PYSEC-2026-3483);
  the elicitation-id field name is resolved from the model schema instead
  of being hard-coded. authplane-fastmcp declares the same direct floor.
- ci: single-source the conformance catalog pin in
  .conformance-catalog-ref (40-hex guarded) and add a scheduled drift
  check; pin ruff to >=0.16,<0.17 so formatting stays stable.

…h matchable errors

The fragment check for a resource indicator lived only in `build_prm_url`, whose
production caller is `AuthplaneResource.prm_url()` — a method reached from
inside a 401 response path. A deployment configured with a fragment-bearing
identifier therefore started normally and failed later, from the failure path,
as a 500. It is now rejected at `AuthplaneClient.resource(...)`, symmetrically
with the issuer check in `create()`, and again in `AuthplaneResource` itself so
the gate holds for a resource built without the factory. The check in
`build_prm_url` stays as a backstop.

`InvalidIssuerError` and `InvalidResourceError` subclass both `AuthplaneError`
and `ValueError`, so existing `except ValueError` handlers keep working while
callers gain the ability to tell an identifier misconfiguration apart from any
other `ValueError` the SDK raises — which matters now that the resource
rejection is a behaviour change deployments have to react to.

`build_prm_url` and `build_metadata_url` no longer strip slashes from the front
of the path: `str.strip("/")` took them from both ends, so `//mcp` lost a
segment and derived the same well-known URL as `/mcp` — two distinct identifiers
collapsing onto one document. RFC 9728 §3.1 and RFC 8414 §3.1 speak only of the
terminating slash.

BREAKING CHANGE: a fragment-bearing resource identifier now raises
`InvalidResourceError` at `client.resource(...)` instead of starting and failing
later. Remove the fragment — RFC 8707 §2 forbids one in a resource indicator.

…ake the PRM hook public

`urlparse` peels an RFC 3986 `;params` segment off the last path segment, so a
request to `/orders;v=2` bound an `htu` of `/orders` — a proof computed over a
different resource than the one being accessed, and RFC 3986 §3.3 puts `;params`
squarely in the path. The htu construction uses `urlsplit`, which does not split
it off, and the round-trip no longer has to fill `urlunparse`'s params slot.

`VerbatimPRMRemoteAuthProvider` is now public (was `_VerbatimPRMRemoteAuthProvider`)
and `rewrite_prm_routes_verbatim` is exported: building a `RemoteAuthProvider` by
hand is a documented FastMCP pattern, and doing so silently lost the verbatim PRM.
`install_request_context(mcp)` now detects a verifier carrying no verbatim
identifiers and warns instead of skipping the rewrite in silence — a verifier
built through the public `AuthplaneTokenVerifier(verifier)` constructor has none,
so the previous `is None` check never fired for it and the served document kept
advertising slash-normalized identifiers that this SDK's own byte-for-byte
comparison rejects. `AuthplaneTokenVerifier.verbatim_identifiers()` exposes the
pair without cross-module private attribute reads.

`install_request_context` also stops touching `mcp.sse_app` unguarded: SSE is not
on the streamable-HTTP path, so a future `mcp` 1.x that drops the attribute would
have taken down servers that never touch SSE.

…kfiles, record the changelog

The conformance suite stops xfailing the inbound DPoP-Nonce case now that the
catalog carries it, and the catalog-fetch tooling is aligned with the pinned ref
so a local run matches CI rather than the moving default branch.

`backport-fixes.sh` accepts a tag as `--from`: `release.yml` deletes
`release/vX.Y.Z` once the tag is pushed, so afterwards the tag is the only ref
naming those commits — which is exactly what the release summary tells the
operator to pass. `--from` and `--to` are validated as ref names before reaching
a fetch refspec, since `git ls-remote` matches its arguments as globs.

`uv.lock` is ignored: nothing tracks or consumes these files — no workflow
installs with uv — so they are local resolution artifacts. Three of them were
swept into a merge commit as untracked files once and accounted for 94% of that
diff. Tracking them for reproducible installs is a real decision and belongs in
its own PR, alongside the CI change that would make them load-bearing.