fix: repo-wide fmt drift + flaky compress test race condition

crates/infigraph-core/src/vuln/mod.rs

@@ -421,7 +421,7 @@ pub fn format_table(report: &VulnReport) -> String {
             truncate_str(&f.dep_name, 20),
             truncate_str(&f.dep_version, 12),
             truncate_str(&f.vuln_id, 18),
-            &f.severity,
+            f.severity,
             summary_truncated,
         ));
     }

crates/infigraph-mcp/src/compress.rs

@@ -1919,6 +1919,9 @@ mod tests {
 
     #[test]
     fn test_compress_pipeline_safe_normal_path() {
+        let _guard = crate::session_context::TEST_LOCK
+            .lock()
+            .unwrap_or_else(|e| e.into_inner());
         crate::session_context::reset_session();
         force_compress_panic(false);
         crate::session_context::record_tool_call("search", false);

crates/infigraph-mcp/src/session_context.rs

@@ -21,6 +21,14 @@ pub fn force_dedup_panic(enabled: bool) {
     FORCE_DEDUP_PANIC.with(|c| c.set(enabled));
 }
 
+/// Serializes tests across this crate that touch the shared `SESSION` static
+/// (or other process-global state like env vars / cwd) — `cargo test` runs
+/// tests in parallel threads within one binary by default, and this state
+/// isn't per-thread, so any test using it must hold this lock for its
+/// duration, not just the ones in this file.
+#[cfg(test)]
+pub(crate) static TEST_LOCK: Mutex<()> = Mutex::new(());
+
 #[derive(Debug, Default, Deserialize)]
 struct ConfigFile {
     #[serde(default)]