[DMC-007] Make CI and release artifacts prove the installed product #6

Priority: P0 for the next public/agent release
Labels: ci, packaging, release, bug, dmcheck
Confidence: 100%

Evidence

CI’s unittest discovers 18 of 35 tests, silently omitting bootstrap, craft, and evidence-bar pytest functions. Branch coverage is 67%; MCP is 0%. CLI/module/MCP/tool/registry versions disagree. server.json pins known-broken 0.5.4. The public sdist omits fixtures and cannot pass its included suite.

Acceptance criteria

• Standardize on pytest or convert all tests; assert expected collection count.
• Branch coverage thresholds per critical module, including MCP/watch/CLI.
• One generated version across metadata, module, CLI, MCP, tool and server manifests.
• Registry installs the current fixed artifact; old broken versions yanked or documented.
• Test extracted sdist and cold-installed wheel; fixtures included or tests consistently excluded.
• Move off EOL Python 3.9 or document a deliberate support exception; update GitHub Actions from repository v4/v5 to reviewed current majors (v7 at the review date).
• Replace setuptools’ legacy license table before its announced 2027 support cutoff.
• Release pipeline implements PORT-006 provenance/artifact controls.

Required tests: current 35 plus P0 regressions; version/manifest snapshot; registry-declared cold init; source distribution self-test; wheel import isolation.

Dependencies: PORT-006; can begin immediately.