feat/issue-558-block-direct-imports
master
# Conflicts: # docs/llm-workflow-runbooks.md
Require a sanctioned MCP daemon (or pytest) before get_auth_header and keychain credential fill so raw shell imports cannot bypass preflight gates.