Add MCP server test suite, stdio smoke test, and trim/pin dependencies #36

Why it matters

The MCP server has no tests. CI only runs py_compile, so the data-path bug, the pipeline mismatch in shader_helper, and the non-compiling scaffolds all shipped through green CI. Dependencies are unpinned and include packages the server never uses.

Evidence

• No tests/ directory anywhere; .github/workflows/validate.yml "Validate MCP server" job runs python3 -m py_compile only.
• mcp-server/requirements.txt: mcp>=1.0.0, fastapi>=0.100.0, uvicorn>=0.23.0. server.py imports neither FastAPI nor uvicorn (stdio transport only). mcp is unbounded across major versions.
• .github/dependabot.yml covers only github-actions, not pip in /mcp-server.
• mcp-server/tools/*.py are 3-line stubs ("exists to maintain the expected directory structure") that CI compiles but nothing imports.

Suggested approach

• Add pytest tests per tool: happy path, no-match path, invalid input, and launching from a different CWD.
• Add an MCP protocol smoke test (start the server over stdio with the mcp client, list tools, call each once).
• Drop fastapi and uvicorn; pin mcp to a compatible range (e.g. mcp>=1.14,<2); move to pyproject.toml.
• Add the pip ecosystem to Dependabot.
• Either move tool logic into mcp-server/tools/ modules (and test them there) or delete the stubs.
• Add ruff lint to CI.

Done when

CI runs a pytest suite plus a stdio smoke test on every PR, and dependencies are minimal and bounded.