Extract a shared MCP Apps host package to remove per-framework duplication

Summary

The MCP Apps host is currently re-implemented once per frontend framework, each hand-rolling the app↔host protocol:

• React: packages/react-core/src/v2/components/MCPAppsActivityRenderer.tsx
• Vue: packages/vue/src/v2/components/MCPAppsActivityRenderer.ts
• Angular: packages/angular/src/mcp-apps/lib/*

This triplication is the root cause of recurring drift between hosts. #6707 migrated the React host onto @modelcontextprotocol/ext-apps (AppBridge + PostMessageTransport), which ties it to the spec at compile time — but Vue and Angular still hand-roll everything, so the same widget now behaves differently depending on the host framework.

Proposal: a shared mcp-apps-support package

Extract a single, framework-agnostic package (working name @copilotkit/mcp-apps-support) that owns the whole host protocol layer on top of @modelcontextprotocol/ext-apps, and have each framework renderer become a thin adapter that only:

1. creates/attaches the sandbox iframe in its own render model, and
2. wires framework-specific glue (agent access, state updates).

The shared core would own everything that is currently copy-pasted and drifting:

• AppBridge + PostMessageTransport wiring and the sandbox-proxy relay (buildSandboxHTML)
• protocol-version negotiation (single LATEST_PROTOCOL_VERSION source)
• host-context seeding (theme/platform, and later display-mode / available-display-modes)
• the CopilotKit behaviors: tools/call proxy + request queue, ui/message role/followUp extensions via _meta.copilotkit, thread-capture semantics (#5819), ui/open-link scheme denylist, tool-input/result forwarding

Why now (concrete drift this removes)

Protocol version is the clearest example. After #6707, React negotiates the MCP Apps protocol version 2026-01-26 (via ext-apps LATEST_PROTOCOL_VERSION), while Vue and Angular still hardcode 2025-06-18:

• packages/vue/src/v2/components/MCPAppsActivityRenderer.ts:9 — const PROTOCOL_VERSION = "2025-06-18";
• packages/angular/src/mcp-apps/lib/mcp-apps-widget.ts:25 — const PROTOCOL_VERSION = "2025-06-18";

Note 2025-06-18 is a base MCP protocol version, independent from the MCP Apps protocol (2026-01-26) — so these hosts are not just behind, they are advertising a version from a different spec line. Historically the same duplication produced other drift too (e.g. size-change vs the spec's size-changed, CSP directive mapping, incomplete capabilities). A shared package fixes this class of bug by construction.

Scope / sequencing

• React is the pilot (#6707); it already consumes ext-apps directly and can be refactored to consume the shared package once it exists.
• Vue and Angular migrate onto the shared package next, deleting their hand-rolled protocol code.
• Follow-up work (display-mode, update-model-context, theme host-context) then lands once in the shared package and is available to all three frameworks.

Refs: #6707