ci: restore deterministic green builds

[arthurpanhku]

Summary

• pin the MCP SDK version that provides the FastMCP import path used by the backend
• add the missing ReportLab dependency for the prompt-injection corpus tests
• upgrade React Router to 7.18.2 to clear the production audit

Root cause

The backend dependency manifest could resolve an MCP package without mcp.server.fastmcp; the prompt-injection corpus also required ReportLab but it was absent from development dependencies. The frontend lockfile still selected React Router 7.18.1, which has two high-severity advisories.

A first CI attempt also showed that the existing macOS-generated hash lock omits Linux-only CUDA transitive hashes, so CI continues to install the primary manifest while the MCP compatibility boundary is pinned explicitly.

Validation

• ruff check app tests evals
• backend: 121 tests passed, 71% coverage
• evals: 5 tests passed
• OpenAPI contract check passed
• frontend: generated API types unchanged
• frontend: 6 tests passed
• npm audit --omit=dev: 0 vulnerabilities
• production build passed

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​react-router-dom@​7.18.1 ⏵ 7.18.2				-1

View full report