Harden CI, restore MCP server & connector safety, add governance and locked deps

[CodeWithJuber]

Motivation

• Fix a malformed merged configuration and restore a reproducible, audited Python packaging and test matrix.
• Ensure the MCP discovery/SDK surface is valid, stable, and compatible with legacy sync callers while enforcing safe connector action metadata.
• Harden repository governance, CI quality/security gates, and secret/vulnerability scanning so PRs run locked installs, linting, type checks, and vetted unit tests.

Description

• Consolidated and corrected pyproject.toml and regenerated uv.lock so the project has a single coherent build backend, pinned runtime/dev dependencies, and consistent test tooling.
• Repaired and simplified hub/mcp_server.py to provide a working MCP SDK create_server() with strict action registry validation, tool annotations (readOnly/destructive/idempotent), bounded concurrency and deadlines, sanitized error classification, and compatibility helpers (_tools, _call_tool, _text) for older discovery codepaths.
• Restored and hardened hub/base.py and connectors/ops/browser.py behavior so connectors fail closed, redact secrets, validate inputs, and require explicit capabilities for sensitive actions (e.g., screenshots) under SecurityPolicy.
• Added professional repository governance and automation: GitHub Actions CI matrix (Python 3.11/3.14), dependency auditing and pinned runtime export for pip-audit, CodeQL scan, Dependabot schedule, PR/issue templates, CONTRIBUTING.md, SECURITY.md, .gitignore additions, and MIT LICENSE.
• Kept compatibility with the existing unit test API surface and generated strict MCP input schemas for legacy discovery via action_json_schema where relevant.

Testing

• Installed locked dependencies with uv sync --frozen --all-groups and confirmed environment preparation succeeded.
• Ran formatting and lint checks: uv run ruff format --check hub/base.py hub/mcp_server.py tests/unit and uv run ruff check hub/base.py hub/mcp_server.py tests/unit which passed for the curated unit suite.
• Ran static typing with uv run mypy and package build with uv build, both completed without errors.
• Ran unit tests with uv run pytest tests/unit which collected 12 unit tests and reported all passing.
• Exported runtime requirements and ran audited dependency scan via uv export --frozen --no-dev --no-emit-project --output-file /tmp/runtime-requirements.txt then uv run pip-audit --require-hashes --no-deps -r /tmp/runtime-requirements.txt, finding no known runtime vulnerabilities for the exported runtime set.
• Validated YAML/GitHub workflow files via Ruby YAML load and python -m compileall -q hub connectors scripts to ensure Python sources compile.

---

Codex Task