chore(conformance): swap vendored tarball pin for pkg.pr.new build @3341d58

Replace the file:./vendor/*.tgz pin (built locally from conformance@d70d7ad)
with the pkg.pr.new build of conformance@3341d58 (main, post #347 + #353).
Pinned by commit SHA rather than PR number so the resolved tarball is
immutable. Content-equivalent to the previous referee; expected-failures
baselines are unchanged.

- test/conformance/package.json: @modelcontextprotocol/conformance →
  https://pkg.pr.new/@modelcontextprotocol/conformance@3341d58
- test/conformance/vendor/: deleted (tarball + .gitignore override)
- README.md: drop local-build/tarball/sha256 instructions; note pkg.pr.new
  pin pending the next npm publish
- expected-failures.yaml: header pin → pkg.pr.new @3341d58
- pnpm-lock.yaml: regenerated

Author: felixweinberger

pnpm-lock.yaml

@@ -4,18 +4,9 @@ This directory contains conformance test implementations for the TypeScript MCP
 
 > `@modelcontextprotocol/conformance` is pinned to an exact version (no `^` range) in `package.json`. New conformance releases are adopted by deliberately bumping the pin and updating `expected-failures.yaml` for any new scenarios/checks in the same change.
 
-> **Local pin (temporary):** the pin currently points at a vendored tarball (`file:./vendor/modelcontextprotocol-conformance-0.2.0-main.d70d7ad.tgz`) built from `modelcontextprotocol/conformance@main` (`d70d7ad`, post-`0.2.0-alpha.4`). This pulls in
-> [#347](https://github.com/modelcontextprotocol/conformance/pull/347) (client-scenario mocks now serve `server/discover`) ahead of the next published release so the discover-shim removal can be exercised. To revert to a published release, replace the `file:` spec in
-> `package.json` with the exact version string (e.g. `"0.2.0-alpha.5"`), delete `vendor/`, run `pnpm install`, and reconcile `expected-failures.yaml` in the same change.
->
-> Tarball sha256: `d09d694de2d3982e511d2b6a91af93b2e09a83f107bfc8f879c090d995e8ecfe`. Rebuild (from a checkout of `modelcontextprotocol/conformance` at `d70d7ad`, with this SDK's workspace `tsdown` on `PATH` because the conformance repo's own devDeps are unavailable on the
-> internal mirror):
->
-> ```sh
-> npm version 0.2.0-main.d70d7ad --no-git-tag-version
-> tsdown                       # deps externalised identically to the published alpha.4 dist
-> npm pack --ignore-scripts
-> ```
+> **Pre-release pin (temporary):** the pin currently points at the [pkg.pr.new](https://pkg.pr.new) build of conformance commit [`3341d58`](https://github.com/modelcontextprotocol/conformance/commit/3341d58) (`https://pkg.pr.new/@modelcontextprotocol/conformance@3341d58` —
+> `main` post-[#347](https://github.com/modelcontextprotocol/conformance/pull/347) and [#353](https://github.com/modelcontextprotocol/conformance/pull/353)). Pinned by commit SHA rather than PR number so the resolved tarball is immutable. Switch to the next published npm
+> release once available, run `pnpm install`, and reconcile `expected-failures.yaml` in the same change.
 
 ## Client Conformance Tests
 

test/conformance/README.md

@@ -2,8 +2,8 @@
 # CI exits 0 if only these fail, exits 1 on unexpected failures or stale entries.
 #
 # Baseline established against the @modelcontextprotocol/conformance pin in
-# package.json (0.2.0-main.d70d7ad — a vendored build of conformance@main; see
-# README.md). Newer conformance releases are adopted by deliberately bumping
+# package.json (pkg.pr.new @3341d58; see README.md). Newer
+# conformance releases are adopted by deliberately bumping
 # the package.json pin and reconciling this file in the same change.
 #
 # NOTE: the SDK's modern-path rejection codes are aligned with this referee's

test/conformance/expected-failures.yaml

@@ -40,7 +40,7 @@
         "test:conformance:all": "pnpm run test:conformance:client:all && pnpm run test:conformance:server:all"
     },
     "devDependencies": {
-        "@modelcontextprotocol/conformance": "file:./vendor/modelcontextprotocol-conformance-0.2.0-main.d70d7ad.tgz",
+        "@modelcontextprotocol/conformance": "https://pkg.pr.new/@modelcontextprotocol/conformance@3341d58",
         "@modelcontextprotocol/client": "workspace:^",
         "@modelcontextprotocol/server": "workspace:^",
         "@modelcontextprotocol/core": "workspace:^",