rmcp 3.2.0 coordinates OAuth refreshes through credential stores and adds request-state key rotation

The official Rust SDK released rmcp 3.2.0 on 2026-08-31, with rmcp-macros 3.2.0 alongside. Both additions extend the authentication work that has defined the 3.x line. OAuth token refreshes now coordinate through credential stores (#1232), so multiple consumers of one credential do not race each other to refresh it, and the signing keys protecting multi round-trip request state can be rotated (#1128). The rotation lands one release after rmcp 3.1.4 began requiring those keys to be 32 bytes.

The fixes are transport-interop items from the deprecation window the 2026-07-28 revision opened: initialize stays functional against legacy protocol versions (#1228), a client whose sessionless server/discover is rejected now falls back instead of stalling (#1211), and Streamable HTTP requests can run concurrently (#1186).

Taken together with the ordering repairs in the Ruby SDK's 1.4.0 released three days earlier, the week's official SDK work was maintenance of the 2026-07-28 surface rather than new protocol coverage: releases that make existing revision support behave correctly under production conditions.