chore(deps): bump mcp-toolsets-runtime to 0.7.0

[ciaransweet]

Moves the runtime pin from <0.6.0,>=0.5.0 to <0.8.0,>=0.7.0 and relocks. Two files, five lines.

The two breaking releases in that span do not reach this repo

0.6.0 and 0.7.0 are both AG-UI wire changes in mcp_agent_api — session-state metadata moving under toolState, then STATE_SNAPSHOT becoming STATE_DELTA. Nothing here imports that module. Every runtime import under toolsets/ and tests/ is mcp_runtime:

mcp_runtime.tool_result        ToolResult, ToolError
mcp_runtime.credentials        header_context, MissingCredentialError
mcp_runtime.fastmcp_output     to_fastmcp          (tests/test_contract.py)
mcp_runtime.server             load_credential_headers

The changelog across 0.5.1–0.7.0 contains no runtime: entry: it is api:, state:, examples: and one mcp-agent:.

The relock reflects that — four lines changed, version and two hashes, no transitive movement.

Session state is live here, in one direction

stac-explorer publishes three keys:

tool	publishes
search_collections	stac-explorer/collections
show_map	stac-explorer/collection, stac-explorer/tile_url

These declarations are derived by the runtime from the ToolResult subclasses' NotRequired fields. They appear in no source file in this repo — a search for produces, Kind or stateKey under toolsets/ returns nothing, and the only place they are visible is _meta on the published tool. Worth knowing before concluding from the source that this repo has no session state.

The consuming direction is dormant: no tool declares consumes, and every tool parameter is a scalar (str, int), so offer_handles adds no @state: branch. No published tool schema changes in this bump. Checked against the running servers.

The one user-visible difference is in the chat host: 0.6.0 reworded the capture breadcrumb to distinguish inspect_state(key) from @state:<key>.

Verification

The 18 tests here exercise the toolsets, not the runtime, so the checks that matter are the entry points the images call:

mcp-serve-local              index up, 3 toolsets, 4 tools
  over MCP                   ui:// and produces meta intact,
                             0 handle branches, hello() returns
mcp-agent-web                Chainlit serves 200 against the local toolsets
mcp-agent install-elements   rewrites McpView.jsx (git-ignored)
console scripts              mcp-serve, mcp-index, mcp-agent, mcp-agent-web,
                             mcp-toolset all present

Both Dockerfile CMDs (mcp-serve, mcp-agent-web) boot on this lock. 18 tests, lint clean.

Deploy consequence

uv.lock is a shared path, so merging redeploys all three toolsets and the chat.