Fix lockfile broken by hand-resolved merge conflict

The web-editor conflict resolution renamed the cordis snapshot keys to
rc.7 but left the mcp-client importer pointing at the deleted
cordis@4.0.0-rc.6(...rc.4) key, so every CI lane failed at
'pnpm install --frozen-lockfile' with ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY.

Align the mcp-client cordis range with the repo-wide ^4.0.0-rc.7 sweep
from master and re-resolve the lockfile with pnpm.

packages/mcp/mcp-client/package.json

@@ -24,7 +24,7 @@
   "peerDependencies": {
     "@deepseek-ai/dsh-tools": "^0.0.1",
     "@deepseek-ai/dsh-llm": "^0.0.1",
-    "cordis": "^4.0.0-rc.6"
+    "cordis": "^4.0.0-rc.7"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.0",
@@ -35,7 +35,7 @@
     "@deepseek-ai/dsh-llm": "workspace:^",
     "@modelcontextprotocol/server-everything": "^2026.7.4",
     "@modelcontextprotocol/server-filesystem": "^2026.7.4",
-    "cordis": "^4.0.0-rc.6",
+    "cordis": "^4.0.0-rc.7",
     "zod": "^4.4.3"
   }
 }

pnpm-lock.yaml

@@ -746,8 +746,8 @@ importers:
         specifier: ^2026.7.4
         version: 2026.7.10(zod@4.4.3)
       cordis:
-        specifier: ^4.0.0-rc.6
-        version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4)
+        specifier: ^4.0.0-rc.7
+        version: 4.0.0-rc.7(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.5)
       zod:
         specifier: ^4.4.3
         version: 4.4.3