Pin mcp below 2.0 so CI can import mcp.server.fastmcp again

mcp 2.0.0 removed the mcp.server.fastmcp module that _mcp.py imports, so the
unbounded `mcp>=1.9` let a fresh CI runner resolve to 2.0.0 and fail
collection with ModuleNotFoundError.

This did not reproduce locally: this machine has mcp 1.28.1 installed, and
ci_mirror.sh caches its clean venv on the hash of requirements.txt, so it
reused an environment resolved back when >=1.9 still meant 1.x. The mirror
validates the resolution you already have, not the one a new runner gets.

Verified against the CI interpreter: a fresh python 3.11 venv built from the
pinned requirements resolves mcp 1.29.0, imports FastMCP, and runs the full
suite -- 1322 passed at 100.00% branch coverage.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QbEaXapjMSkxyzgvbdkUFb

pyproject.toml

@@ -20,7 +20,7 @@ dependencies = [
 # dependency so the systemd/CLI system-python path stays dependency-light and
 # never has to import the MCP SDK.
 [project.optional-dependencies]
-mcp = ["mcp>=1.9"]
+mcp = ["mcp>=1.9,<2"]
 
 # Explicit package discovery. Without this, setuptools' flat-layout
 # auto-discovery aborts because the repo root holds two top-level dirs

requirements.txt

@@ -6,7 +6,7 @@ bandit>=1.7.0
 codespell>=2.2.0
 coverage>=7.4.0
 howlongtobeatpy>=1.0
-mcp>=1.9
+mcp>=1.9,<2
 mypy>=1.8.0
 pre-commit>=3.6.0
 pylint>=3.0.0