fix(tests): the packaging guard was inert on Python 3.10, the declared minimum

[neosun100]

What this sweep ran

The previous sweep covered unit, regression, property-at-5000 and the scenario E2E layer. This one ran the layers it had not:

layer	result
8 × iac-cdk/test/*.test.ts (CI-only, never run locally)	8/8 pass via npx ts-node
terraform fmt -check -recursive + validate	clean
4 specialists' A2A entrypoints, executed offline	4/4 exit 0
Full suite on Python 3.10 (the declared minimum)	found the defect below

The finding

3.10 reported 3686 passed / 13 skipped against 3.13's 3693 / 6. Seven of the extra skips were all of test_packaging.py's pyproject-reading half:

3.10    5 passed,  7 skipped
3.13   12 passed

The module did tomllib = None on 3.10 and the fixture skipped. Since requires-python = ">=3.10", those seven tests were inert on the project's own floor version — including test_registry_yaml_is_declared_as_package_data, the INV-MCP-2 wheel guard added in round 20 for a defect that made every pip-installed MCP server fail open.

CI's 3.11+ legs kept the guard honest, so nothing was actually unprotected. But a guard that evaporates on the minimum supported version is a guard with a hole documented in its own skip message — and the skip reason ("tomllib requires Python 3.11+") reads like a fact of nature when tomli is the standard backport with an identical API.

The fix

A two-line import fallback plus a marker-gated test dependency (tomli>=2.0; python_version<'3.11', so 3.11+ installs nothing extra). Both versions now report 3693 / 6 — identical coverage.

Positive-controlled on 3.10 specifically: emptying [tool.setuptools.package-data] now fails test_registry_yaml_is_declared_as_package_data there, where before it skipped and the defect would have shipped.

Verification

• 3693 passed / 6 skipped on Python 3.10 AND 3.13 (3.10 was 3686/13)
• 8/8 CDK stack tests · terraform fmt/validate clean · 4/4 specialists offline
• ruff clean · both mypy gates clean · make ci green (lint / coverage ≥88 / iac synth / secret-scan)