fix(guard): close allow_test_bootstrap and basename entrypoint bypasses (#695)

Remove the public allow_test_bootstrap production seam so caller-controlled
flags cannot forge native mutation provenance. Bind provenance to the resolved
canonical entrypoint path plus a live stdio transport bind; basename-only
mcp_server.py stack frames and import-only launch no longer authorize
mutations. Test-mode install_test_native_runtime is pytest-only and cannot
reach production Gitea mutation endpoints. Add AC9 regressions for both
reviewer-found bypasses and related spoof vectors.

Refs: PR #696 REQUEST_CHANGES at 253269c; issue #695 comments 11002/11005.

tests/test_mcp_daemon_guard.py

@@ -30,11 +30,17 @@ class TestMcpDaemonGuard(unittest.TestCase):
         # Running under pytest already sets PYTEST_CURRENT_TEST.
         mcp_daemon_guard.assert_sanctioned_mutation_runtime("pytest")
 
-    def test_mark_sanctioned_bootstrap_allows(self):
+    def test_test_native_runtime_install_under_pytest(self):
         mcp_daemon_guard.clear_native_runtime_for_tests()
-        mcp_daemon_guard.mark_sanctioned_daemon(allow_test_bootstrap=True)
-        mcp_daemon_guard.assert_sanctioned_mutation_runtime("daemon")
+        mcp_daemon_guard.install_test_native_runtime()
         self.assertTrue(mcp_daemon_guard.is_native_mcp_transport())
+        self.assertFalse(mcp_daemon_guard.is_production_native_mcp_transport())
+        # Hermetic unit path still passes under pytest.
+        mcp_daemon_guard.assert_sanctioned_mutation_runtime("daemon")
+        # Production mutation gate rejects test-mode records.
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError) as ctx:
+            mcp_daemon_guard.assert_production_mutation_runtime("gitea_mutation")
+        self.assertIn("Test-mode", str(ctx.exception))
 
     def test_env_alone_insufficient_when_force_unsanctioned(self):
         mcp_daemon_guard.clear_native_runtime_for_tests()
@@ -87,6 +93,11 @@ class TestMcpDaemonGuard(unittest.TestCase):
             with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError):
                 gitea_auth.get_auth_header("gitea.prgs.cc")
 
+    def test_no_allow_test_bootstrap_public_parameter(self):
+        """Production mark must not accept allow_test_bootstrap (#695)."""
+        sig = __import__("inspect").signature(mcp_daemon_guard.mark_sanctioned_daemon)
+        self.assertNotIn("allow_test_bootstrap", sig.parameters)
+
 
 if __name__ == "__main__":
     unittest.main()