ci: add CI and take the quality gates from base-repo

[sinkog]

Brings this repository's quality gates up to what base-repo's mcp branch got today, and adds the CI that enforces them.

The manifest-driven design is untouched: knowledge.sources.yaml stays the declared desired state, .gitmodules stays a generated artifact. This is about tightening what surrounds it.

Why now

This repository had no CI: no workflow, no runs, an unprotected main. Nothing ran the linters, the type checker, or the tests — so all three had drifted, exactly as base-repo's mcp branch had. Most of these files were byte-identical to base-repo's before today, so the fixes port across unchanged.

What lands

Quality config, from base-repo mcp/main — .yamllint (indent-sequences: consistent, since the generated companions use PyYAML's block style and hand-written YAML indents), .bandit (skips with their reasons, replacing a run that failed on the import of subprocess), and mypy stub overrides.

CI, retriggered for this repo's branches, plus one step base-repo cannot run: rendering .gitmodules from knowledge.sources.yaml. There is nothing to diff against — the file is gitignored — but rendering fails on a malformed manifest, and that manifest is what this repository is built around. Verified: it exits 1 on a broken kind:.

This also puts test_mcp_server_write_confinement.py — the proof that the write tools cannot escape SOURCE_DIR — under automation for the first time.

Fixes, ported from base-repo. Three were real:

• a dead file_path in search_code, left over from when file_paths replaced the single path
• _watch_loop passed Path | None into _scan_watch_dir. Unlike base-repo, the loop is live here — threading.Thread starts it — so it now states its precondition instead of failing deeper.
• the ManualInterventionRequired handler: a release stopping for a human exited 1 instead of 0. The exception class survived, the handler did not.

validate removed. It announced "Validating all schemas against the meta-schema" and did nothing: run_validation() is commented out with "Assuming a validation method exists" and no such method exists. Upstream it resolves sources/index.yaml — CIC_Schemas territory. This repository has no canonical schema source. What could sensibly be validated here is companion YAML against the meta-schemas and knowledge.sources.yaml; the CI now covers the latter. CLI is {check,prepare,close}.

Tests repointed at the phase API. They still described the design that run_release_close was split out of, while ReleaseManager already exposes run_check / run_prepare_release / run_finalize_release. Remapped by what each asserts. Two were deleted with their subjects. One was a false green: release had stopped being a valid command, so argparse exited 2 before the assertion meant anything.

Result

	before	after
CI	none	green
ruff	30	0
yamllint	648	0
mypy	12	0
bandit	4	0
tests	17 failed, 128 passed	143 passed

Not in this PR

The code sync from base-repo — make_source.py (+143 lines), server.py (+292), kb_watch.py (+261). That is not a version gap but a design difference: base-repo drives the watcher as a subprocess over watchdog, this repo runs it in-process on a thread. Adopting it is an architectural decision, not a sync.

knowledge.sources.yaml still points cic-basic-knowledge at github_private. Repointing it at the new cic-knowledge repo is ready and waiting on its own branch.

.bandit skips are global: a new shell=True anywhere in tools/ would now pass unflagged. A per-call # nosec B602 would be narrower if that trade stops being acceptable.

tools/infra.py keeps import requests # noqa: F401 — nothing calls it, but test_infra patches tools.infra.requests.get. Both go when those tests are properly rewritten.