chore: public-release audit

[lorr1]

Prepares the repo to flip from internal to public as a reusable MCP server template.

Summary

• Security: pins lxml>=6.1.0 (CVE-2026-41066) and python-dotenv>=1.2.2 (CVE-2026-28684) following the existing pattern for cryptography / python-multipart. pip-audit now reports 0 vulnerabilities.
• Dependency refresh: bumps all direct, dev, and security deps to current fix-floors, closing out the open Renovate PR backlog in a single pass (supersedes Update dependency bandit to >=1.9.4 - autoclosed #19, Update dependency cyclonedx-bom to >=7.3.0 - autoclosed #24, Update dependency pip-audit to >=2.10.0 - autoclosed #25, Update dependency pydantic to >=2.13.3 #26, Update dependency pytest-asyncio to >=1.3.0 - autoclosed #29, Update dependency ty to >=0.0.32 #30; Update actions/checkout action to v5.0.1 - autoclosed #18/Update dependency cachetools to >=6.2.6 - autoclosed #21/Update dependency cyclonedx-bom to >=6.1.3 - autoclosed #22/Update dependency pytest to >=9.0.2 - autoclosed #27 are stale).
• Renovate unblocked: adds a packageRule disabling dhi.io/** Docker lookups, which was causing the "Action Required: Fix Renovate Configuration" issue (Action Required: Fix Renovate Configuration #39).
• CI cleanup: removes the claude.yml / claude-code-review.yml review workflows so a public fork does not burn ANTHROPIC_API_KEY on drive-by PRs.
• Release workflow stubs polished: the three release workflows ship stubbed (the template itself should not publish artifacts). Comments now spell out the exact unstub steps for consumers and point at docs/release-playbook.md.
• Docs: README reframed for a public audience (DHI is free as of late 2025, a free Docker Hub account is enough; new "For fork maintainers" section enumerates required secrets). SECURITY.md casing fixed. New CONTRIBUTING.md with setup + Conventional Commits + DCO sign-off, pointing to the org-level Code of Conduct in StacklokLabs/.github.
• Fix: task run now uses python -m mcp_template_py (matching the Dockerfile and README) instead of the broken python -m src.mcp_template_py.
• Test compat: the ty upgrade surfaced two pre-existing narrowing issues in the test suite (fixed: switched to isinstance(item, TextContent) and Settings.model_validate).

Test plan

• task check passes locally (lint, format, typecheck, 11 tests pass / 3 integration skipped, bandit 0 issues, pip-audit 0 vulns)
• pip-audit --ignore-vuln CVE-2026-4539 reports No known vulnerabilities found
• Full CI green on this PR
• Manual: task run works end-to-end
• Manual: task compose builds against DHI (requires docker login dhi.io)

After merge

Separate cleanup (will handle after this lands):

• Close stale Renovate PRs (Update actions/checkout action to v5.0.1 - autoclosed #18, Update dependency cachetools to >=6.2.6 - autoclosed #21, Update dependency cyclonedx-bom to >=6.1.3 - autoclosed #22, Update dependency pytest to >=9.0.2 - autoclosed #27) as superseded
• Close resolved Renovate PRs (Update dependency bandit to >=1.9.4 - autoclosed #19, Update dependency cyclonedx-bom to >=7.3.0 - autoclosed #24, Update dependency pip-audit to >=2.10.0 - autoclosed #25, Update dependency pydantic to >=2.13.3 #26, Update dependency pytest-asyncio to >=1.3.0 - autoclosed #29, Update dependency ty to >=0.0.32 #30)
• Close issue Dependency Dashboard #20 (Dependency Dashboard — will regenerate) and Action Required: Fix Renovate Configuration #39 (Renovate config — fixed here)
• Add repo topics: mcp, fastmcp, python, template, model-context-protocol
• User manually flips visibility to public

[glageju]

TIL: This was the reason for blocking PAT to trigger downstream workflows. 🤗

[lorr1]

Yep — GITHUB_TOKEN is intentionally barred from triggering downstream workflows to prevent infinite-loop footguns. The GitHub App token dance is the sanctioned escape hatch. 🫠

[glageju]

Should we reword "Fork"? I don't think creating a new repo from template repo is a real "Fork"ing.
From claude:

❯ Is creating a new repo from  github repo template a fork'ing ?                                                                                                      
                                                                        
⏺ No — creating a repo from a template is not a fork.                                                                                                                 
                                                                                                                                                                      
  Key differences:                                                                                                                                                    
  - Template: new repo starts with a clean history (single initial commit), no link to the source, independent from the start.
  - Fork: preserves full git history, stays linked to upstream, and can send/receive PRs via that link.                                                               
                                                                                                                                                                    
  Use a template when you want a starting point; use a fork when you want to contribute back or track upstream.  

[lorr1]

Good catch — fixed in 14d28a6. Renamed the section to "When Using This Template" and switched the workflow comments to "in your own repo" so the language covers both the template-copy case (common) and the actual-fork case (contribute-back).