Node: expose MCP server instruction policy

[OllieinCanada]

Fixes #2379

Summary

• expose allowAllMcpServerInstructions on the shared TypeScript session config
• forward explicitly configured true and false values through both session.create and session.resume
• omit the option when it is not configured, preserving the runtime's allowlist-based default

The generated session.rpc.options.update surface already supports this field. This change fills the missing public create/resume path without modifying the generated protocol types.

Security

Enabling this option broadens the session's instruction trust boundary. The public API documentation calls that out, and the SDK does not enable it by default or silently coerce an omitted value.

Tests

Deterministic mocked-transport tests cover explicit true, explicit false, and omission for both create and resume. They require no Copilot model or external service.

Local validation:

• focused Vitest regression: 3 passed
• TypeScript typecheck: passed
• build: passed
• ESLint: 0 errors (5 pre-existing warnings in untouched tests)
• Prettier check for all three touched files: passed
• git diff --check: passed