fix(mcp): break Python transport import cycle

[lusoris]

Summary

Breaks the Python MCP server -> http_transport -> server cycle reported by CodeQL alerts 917/918 without hiding an import behind dynamic loading. HTTP scoring now crosses a narrow HttpScoringRuntime protocol, and explicitly injected runtimes are bound to each aiohttp application so concurrent embedded servers cannot overwrite process-global policy. The default [dev] extra now includes Prometheus so the HTTP and concurrency regressions actually execute in CI instead of silently skipping at collection.

This is stacked on #1536. Merge #1536 first; once it lands, this PR's one prerequisite commit/diff disappears against master.

Type

• fix — bug fix
• refactor — preserves scoring behavior while repairing dependency direction

Checklist

• Commits follow Conventional Commits.
• make format && make lint — focused Ruff lint/format, changed-file pre-commit, markdownlint, semgrep, governance, HISS, and generated-doc checks passed.
• Unit tests pass: the complete MCP suite in a fresh Python 3.14 [dev] environment reports 533 passed, 19 skipped.
• No SIMD/GPU code path or extractor twin was touched.
• No C-family file was added.
• This is not a breaking change; ordinary CLI startup keeps the canonical adapter and embedding gains explicit per-server isolation.
• ADR-1304, its index fragment/order entry, generated index, and tag projections are included.

Bug-status hygiene

• docs/state.md records alerts 917/918 as fixed in source, names the regression test, and leaves hosted closure pending the post-merge CodeQL run.

Netflix golden-data gate

• No Netflix assertAlmostEqual(...) score or golden fixture was modified.
• No golden-value exception is requested.

Cross-backend numerical results

Not applicable: the scoring implementation and numerical output contract are unchanged; only HTTP dependency direction and runtime ownership changed.

Deep-dive deliverables

• Research digest — docs/research/2028-code-scanning-audit-2026-09-03.md records the alert evidence and updated decision matrix; docs/research/2040-code-scanning-cleanup-1243.md carries the cleanup ledger.
• Decision matrix — ADR-1304 and Research-2028 compare dynamic import hiding, a large helper move, a temporary global swap, and per-application binding.
• AGENTS.md invariant note — mcp-server/AGENTS.md pins both the acyclic dependency direction and the default HTTP test dependencies.
• Reproducer / smoke-test command — below.
• CHANGELOG fragment — changelog.d/fixed/mcp-python-cyclic-imports.md.
• Rebase note — docs/rebase-notes.md records the import-DAG and per-application ownership invariants.

Reproducer

python3 -m venv /tmp/vmafx-mcp-cycle
/tmp/vmafx-mcp-cycle/bin/pip install -e 'mcp-server/vmaf-mcp[dev]'
VMAF_BIN=/path/to/vmaf /tmp/vmafx-mcp-cycle/bin/python -m pytest -q \
  mcp-server/vmaf-mcp/tests

Local result on CPython 3.14.7 with aiohttp 3.14.3 and Prometheus 0.26.0: 533 passed, 19 skipped in 3.36s. The fresh editable install proves the corrected [dev] dependency surface; all HTTP round-5 and import-graph regressions execute. Focused Ruff lint/format, make docs-fragments-check, changed-file pre-commit, and git diff --check pass.

Known follow-ups

• Merge prerequisite test(mcp): stream oversized aiohttp payload #1536 before this PR.
• CodeQL alerts 917/918 can only be called hosted-closed after this exact source reaches master and the post-merge analysis reports them closed.
• Full-file mypy on the legacy server.py still reports its existing optional AI import and MCP SDK alias debt; the new http_scoring.py and changed transport are clean, and this repository's enforced mypy scope passes.