jsonrpc: numeric request IDs above 2^53 lose precision #1376

Describe the bug

Decoding the numeric JSON-RPC request ID 9007199254740993 changes it to 9007199254740992. This affects request/response correlation: a server can execute a request successfully but echo the wrong ID, and distinct numeric IDs can collapse to the same internal ID.

To Reproduce

Run this program with github.com/modelcontextprotocol/go-sdk v1.8.0:

package main

import (
    "fmt"

    "github.com/modelcontextprotocol/go-sdk/jsonrpc"
)

func main() {
    input := []byte(`{"jsonrpc":"2.0","id":9007199254740993,"method":"ping"}`)
    msg, err := jsonrpc.DecodeMessage(input)
    if err != nil {
        panic(err)
    }
    output, err := jsonrpc.EncodeMessage(msg)
    if err != nil {
        panic(err)
    }
    fmt.Println(string(output))
}

Expected behavior

The ID remains 9007199254740993:

{"jsonrpc":"2.0","id":9007199254740993,"method":"ping"}

JSON-RPC requires the response ID to match the request ID: https://www.jsonrpc.org/specification#response_object

Logs

Actual output:

{"jsonrpc":"2.0","id":9007199254740992,"method":"ping"}

A separate raw HTTP reproduction against an SDK Streamable HTTP server also returned HTTP 200 with ID 9007199254740992 for a successful tools/call request whose ID was 9007199254740993. The application handler did not manipulate IDs. String ID "9007199254740993" was preserved correctly.

Additional context

• Reproduced with SDK v1.8.0 and main at 944ac19.
• Go: go version go1.27.1 darwin/arm64.
• Root cause: the wire ID is decoded through float64 before conversion to int64. Precision is lost before the application can intervene.
• This concerns JSON-RPC envelope IDs and cancellation correlation, rather than tool argument, schema, or structuredContent precision discussed in mcp: typed tool arguments lose precision for large int64 values #1201, mcp: tool schemas and metadata lose JSON number precision #1310, and mcp: CallToolResult structuredContent loses large integer precision #1236.

Proposed fix: #1375. It preserves numeric IDs within int64, keeps integral decimal/exponent forms, and preserves cancellation request IDs. The regression test fails before the patch and passes afterward; full Go tests and targeted race tests pass. The PR also documents the numeric cancellation field's dynamic type change to json.Number and the int64 range boundary. The fix is proposed, not yet merged or released.