test: verify the SSE crawl transport end to end

[memtomem]

What and why

ServerSpec has always accepted transport: sse, and crawler/transports.py
has always had a branch for it. Nothing in the repository ever executed that
branch. No test, no script, no CI job constructed a spec with
transport="sse", and the fixture server could not speak SSE at all, so the
branch could not have been covered even by accident. The MCP 2.x migration
(#99) rewrote that module with SSE untested.

That is the failure shape this repo has been bitten by before: a broken script
sat green through 14 PR checks because only a scheduled workflow ran it. A
public surface looks supported because the type admits it.

The good news: SSE works. It was verified green at both mcp 2.1.1, the
declared floor, and 2.2.0, the current lockfile version. Nothing was broken.
This PR makes that a fact CI enforces rather than an assumption.

Changes

file	change
tests/fixtures/sample_server.py	new sse argv mode; without it SSE was untestable
tests/test_crawler.py	_serve(mode) helper shared by both HTTP fixtures; new test_crawl_sse
scripts/verify_mcp_floor.py	streamable_http() generalized to http_transport(mode, transport, path); sse leg added
tests/test_release_hardening.py	pins credential redaction for SSE URLs
toolgraph/crawler/transports.py	docstring only, no runtime change
README.md, CHANGELOG.md	docs

The floor script is the deliberate home for the SSE leg. minimum-mcp is a
required PR check that installs the declared floor, so this cannot go stale the
way a schedule-only script can. It adds one server subprocess per invocation.

Review findings applied

Codex reviewed this and returned SHIP with no blockers and no majors. Two
minors were real and are fixed here:

• The fixture teardown called proc.kill() without a following wait(), so
  teardown could return with the child still exiting and the next test racing
  it for a port. Pre-existing, but now shared by two fixtures.
• The floor script built all its legs as coroutine objects up front, so a
  failing leg left the later ones unawaited and buried the real error under
  RuntimeWarnings. They are now built from factories.

Verification

uv run pytest -q                                      583 passed
uv run ruff check .                                   All checks passed
scripts/verify_mcp_floor.py @ mcp 2.2.0               [ok] sse lists tools
scripts/verify_mcp_floor.py @ mcp 2.1.1 (floor)       [ok] sse lists tools

Not covered

ServerSpec.headers is forwarded to upstream MCP servers by both HTTP
transports and is still never tested with a non-empty value. The two transports
use different SDK mechanisms there, so one can break without the other, and it
is the auth path. Filed as #103; this PR does not close it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ue4wAZWpL7PFe7ARenR7fz