fix(guard): close allow_test_bootstrap and basename entrypoint bypasses (#695)

Remove the public allow_test_bootstrap production seam so caller-controlled
flags cannot forge native mutation provenance. Bind provenance to the resolved
canonical entrypoint path plus a live stdio transport bind; basename-only
mcp_server.py stack frames and import-only launch no longer authorize
mutations. Test-mode install_test_native_runtime is pytest-only and cannot
reach production Gitea mutation endpoints. Add AC9 regressions for both
reviewer-found bypasses and related spoof vectors.

Refs: PR #696 REQUEST_CHANGES at 253269c; issue #695 comments 11002/11005.

gitea_mcp_server.py

@@ -12843,9 +12843,10 @@ def gitea_quarantine_contaminated_review(
     427 until an independent adversarial reviewer and controller deployment
     of this tooling have completed.
     """
-    # Fail closed outside native MCP before any mutation assessment.
+    # Fail closed outside production native MCP before any mutation assessment.
+    # Test-mode bootstrap must never reach this production mutation endpoint (#695).
     try:
-        mcp_daemon_guard.assert_sanctioned_mutation_runtime(
+        mcp_daemon_guard.assert_production_mutation_runtime(
             "gitea_quarantine_contaminated_review"
         )
     except mcp_daemon_guard.UnsanctionedRuntimeError as exc:
@@ -13051,10 +13052,12 @@ def gitea_quarantine_contaminated_review(
 # ── Entry point ───────────────────────────────────────────────────────────────
 
 if __name__ == "__main__":
-    # #558 / #695: mark this process as the official native MCP daemon before
-    # any tool dispatch. Env vars alone cannot reconstruct native transport;
-    # offline imports / standalone scripts fail closed on mutations.
+    # #558 / #695: claim the resolved canonical entrypoint, then bind the live
+    # native MCP transport lifecycle before any tool dispatch. Env vars,
+    # basename-only stack frames, and import-only launch cannot reconstruct
+    # native transport; offline imports / standalone scripts fail closed.
     mcp_daemon_guard.mark_sanctioned_daemon()
+    mcp_daemon_guard.bind_native_mcp_transport(transport="stdio")
     # Lock this session's launch profile into the environment so child CLI
     # processes (e.g. review_pr.py) can detect and refuse profile
     # side-channel overrides (#199).