chore(mcp-apps-renderer): tighten the activity UMD build and attw coverage

Follow-up asks from Ben's review, plus a version alignment:

- Add codeSplitting: false to the activity UMD build (matching a2ui-renderer), so
  it emits a single self-contained activity.umd.js. Without it a sibling chunk
  could leave the CopilotKitMcpAppsRendererActivity global incomplete, and
  es-check (syntax-only) would not catch it.
- Run attw as two analyses instead of a package-wide suppression: the root
  entry with the esm-only profile (it wraps the ESM-only ext-apps bridge, so its
  CJS resolution is intentionally absent while ESM and type checks stay active),
  and the remaining entries with node16. This keeps no-resolution enforced on
  every other entry point instead of silencing the rule for the whole package.
- Bump the package version 1.70.1 to 1.71.0 to match the shared-version monorepo
  scope, and regenerate the public API manifest.

packages/mcp-apps-renderer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@copilotkit/mcp-apps-renderer",
-  "version": "1.70.1",
+  "version": "1.71.0",
   "private": false,
   "description": "Framework-agnostic MCP Apps host for CopilotKit - the app<->host protocol (ext-apps AppBridge), sandbox proxy, and shared renderer consumed by the React, Vue, and Angular frontends",
   "keywords": [
@@ -54,7 +54,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "publint": "publint .",
-    "attw": "attw --pack . --profile node16 --ignore-rules no-resolution"
+    "attw": "attw --pack . --profile esm-only --entrypoints . && attw --pack . --profile node16 --exclude-entrypoints ."
   },
   "dependencies": {
     "@copilotkit/shared": "workspace:*",

packages/mcp-apps-renderer/tsdown.config.ts

@@ -56,6 +56,10 @@ export default defineConfig([
     target: "es2018",
     outDir: "dist",
     external: (id: string) => id === "zod" || id.startsWith("zod/"),
+    // Force a single self-contained bundle (matches a2ui-renderer): without this,
+    // a sibling chunk emitted next to activity.umd.js would leave the global
+    // incomplete, and es-check (syntax-only) would not catch it.
+    codeSplitting: false,
     outputOptions(options) {
       options.entryFileNames = "[name].umd.js";
       options.globals = { zod: "Zod" };

scripts/release/public-api/manifest.v1.json

@@ -1019,7 +1019,7 @@
     },
     {
       "name": "@copilotkit/mcp-apps-renderer",
-      "version": "1.70.1",
+      "version": "1.71.0",
       "sourceDirectory": "packages/mcp-apps-renderer",
       "entrypoints": [
         {