Phase 3: cut SDK 1.0.0 with legacy bundle methods routed through /v1/servers

[mgoldsborough]

Once Phase 2 (#101) ships, prepare consumers for the /v1/bundles/... route removal in Phase 4 by cutting an SDK major.

Two compatible paths, pick one

A. Adapter-mode 1.0 — keep the legacy searchBundles / getBundle* / getBundleDownload methods callable, but route them through the new /v1/servers/... endpoints internally and synthesize the legacy response shape. Consumers don't change code; they just bump the SDK pin.

• ✅ Zero-friction migration for callers
• ⚠️ Forces the SDK to keep two response shapes alive in code; legacy fields like bundle.tools[] need synthesis from _meta

B. Hard-break 1.0 — remove the legacy methods. Callers update to searchServers / getServer / getServerDownload. Keep a 0.x branch with the legacy methods for the deprecation window.

• ✅ Clean SDK code
• ⚠️ Every consumer (CLI, web, NimbleBrain platform, external) must touch their import sites

Recommendation: B — the legacy shape is shallow and the call-site churn is mostly mechanical. Track external SDK download numbers before flipping to gauge blast radius.

Migration of mpak's own consumers

• apps/web — switch bundle detail / search pages to the new methods (uses BundleSearchResponse and BundleDetail types today)
• packages/cli — mpak search, mpak packages show, mpak packages search, mpak packages pull/run all touch the legacy methods
• apps/registry integration tests that hit the legacy endpoints stay (they're the deprecation-headered surface; we want to keep test coverage on them until Phase 4)

Cross-org impact

NimbleBrain platform (nimblebrain#195 follow-up) bumps the pin and replaces its raw fetch in MpakRegistry. mpak#100's PR body documents this.

Definition of done

• SDK 1.0.0 published to npm + PyPI
• apps/web migrated; bundle detail page renders from ServerDetail
• packages/cli migrated; mpak packages show reads from getServer() + _meta for tools/certification
• CHANGELOG entry calls out the migration with a one-liner code diff per legacy method
• Migration guide added to apps/docs

Blocks

• Phase 4 — drop /v1/bundles GET routes (this issue must complete first)

Blocked by

• Phase 2: close the gaps that block /v1/bundles deprecation #101 (Phase 2)