Summary

Send notifications/initialized after the DNS rebinding scenario completes a successful dated-spec initialize probe against the valid localhost Host/Origin pair.

Root Cause / Context

The scenario currently performs a valid initialize request for the localhost Host/Origin check, then marks the check successful without completing the dated MCP initialization lifecycle. Servers that require notifications/initialized after a successful initialize can fail or hang even though the Host/Origin validation itself is correct.

Changes

• Capture the Mcp-Session-Id returned by the valid Host/Origin initialize probe.
• Send notifications/initialized for dated specs after the valid initialize succeeds, preserving the session id when one is issued.
• Keep the server/discover path unchanged.
• Add regressions covering the dated initialized notification sequence and the server/discover no-notification boundary.

Scope / Risk

This only changes the DNS rebinding scenario's valid-host success path. The invalid Host/Origin rejection probe is unchanged, and server/discover traffic still does not send notifications/initialized.

Verification

npm test -- src/scenarios/server/negative.test.ts -t "dns-rebinding-protection"
npm test -- src/scenarios/server/negative.test.ts
npm run typecheck
npm run lint
npm run build
npm test

All commands passed.

Closes #338