[codex] Fix audit findings for defense readiness

[olyannaa]

What changed

This PR applies code-level fixes from the pre-defense audit, split into focused commits:

• fixes package author metadata;
• adds pytest-cov and an 80% coverage gate to CI;
• adds live ClickHouse integration tests for real SQL -> expected rule_id behavior;
• declares optional ML experiment dependencies and records SHA-256 hashes for experiment artifacts;
• hardens the Streamable HTTP MCP demo endpoint with bearer-token enforcement, rate limiting, and local-only detect_ch_version by default;
• adds a leakage-aware risk baseline without explicit rule-derived features and rule-shaped parser flags;
• syncs MCP rule catalog wording and tier filters with the 119-rule registry.

Why

The audit found several real engineering and DS risks: unverifiable coverage, weak live integration coverage, ML dependency reproducibility gaps, public MCP security concerns, and a risk of overstating rule-derived ML metrics. These changes make the repository easier to defend because the claims are now backed by code, CI gates, artifacts, and explicit security boundaries.

Validation

Ran locally:

poetry run python scripts/rules/validate_catalog.py
poetry run python scripts/benchmark/validate_cases.py
poetry run pytest --ignore=tests/integration -q
poetry run ruff check clickadvisor tests scripts
poetry run mypy clickadvisor
poetry run python scripts/eval/run_benchmark.py --cases-dir benchmark/cases/synthetic_expanded --mode strict
poetry run pytest tests/integration/ -q

Results:

• 119 rule cards validated;
• 327 benchmark cases validated;
• unit tests passed;
• Ruff passed;
• mypy passed;
• strict benchmark: 222 cases, precision/recall/F1 = 1.000;
• integration tests: 6 passed.