chore(deps): upgrade the MCP Apps extension SDK to 2.0.4 #2811

A new MCP Apps extension SDK release is out. What is installed on v2/main is behind what the npm registry publishes.

Release notes: https://github.com/modelcontextprotocol/ext-apps/releases

Why this is an issue and not a PR

Filed by the nightly SDK watch (#1063), the third of this repo's issue-filing sweeps alongside the monthly dependency refresh (#2229) and the daily Dependabot alert sweep (#2233). None of them opens a PR: a bot-authored PR carries no Closes #N and no board card, so the work would be invisible to the board. A maintainer picks this up and opens a normal PR against v2/main.

Upgrade checklist

• No manifest edit needed — the declared range already admits 2.0.4, so this is a lockfile refresh. (every runtime dependency core/ imports is declared in the repo-root package.json and nowhere else (Dependency placement), so if that ever stops being true the bump belongs there.)
• npm install at the root, and commit the refreshed lockfile.
• Re-check the bundler external lists (clients/{cli,mcpdo,tui}/tsdown.config.ts, clients/web/tsdown.runner.config.ts) if the release adds or renames an entry point; npm run verify:bundle-externals enforces this against the built output.
• npm run format, then npm run local:gate.

An automated review of what actually changed upstream — and which parts of this app it touches — is posted as a comment below.

A later run of this sweep will not refile this issue. A further SDK release files its own issue and leaves a supersession note here rather than editing this one.