[esren0x]

Why

AgentKit's executable MCP server remained pinned to the 0.12.0 SDK stack after the upstream repositories and published packages moved to 0.12.1. Pulling those repositories does not update this package's dependencies. This aligns the MCP installation with the reviewed 0.12.1 release.

Changes

• Pin all six direct Provable packages to 0.12.1: aleo-bridge-sdk, sdk, shield-swap-sdk, veil-aleo-devnode, veil-aleo-sdk, and veil-core.
• Update the pnpm lockfile, including the SDK's @provablehq/wasm dependency at 0.12.1. Preserve unrelated dependency versions.
• Update current MCP version references and record the new offline validation evidence. Preserve the historical 0.12.0 mainnet results as historical evidence.

This PR is based directly on master and contains no runtime source changes. Claim recovery remains in #8; executable CI remains a separate workstream.

Validation

• Frozen-lockfile installation with the repository's pnpm 10.33.2.
• MCP TypeScript checking and build passed.
• All 77 MCP tests passed against the final lockfile.
• All 25 repository tests passed; git diff --check passed.
• Built a tarball and installed it in a fresh consumer project outside SDK workspaces. The installed smoke test passed SDK key import, encrypted persistence, guided profile reuse, structured readiness, all 20 stdio tools, testnet bridge discovery, and two process restarts.

No live transactions were executed. Existing optional wallet-provider peer warnings remain, including Privy's Solana Kit mismatch. The xReserve outbound release verification limitation remains documented for SDK 0.12.1.