Fix quarantine and registry data-loss regressions

[cursor]

Bug and impact

• apply_merge() could delete an existing threat-registry projection during rollback if the projection existed but could not be backed up before an SSOT write failure.
• Quarantine quota eviction could choose the just-committed pair as the oldest victim, causing quarantine() to return a path to evidence it had already deleted under timestamp ties or clock skew.
• Fresh installs could resolve MCP 2.x, crashing MCP entry points that still use the MCP 1.x FastMCP API.

Root cause

• Projection backup read failures were treated the same as no previous projection.
• Post-commit eviction had no way to protect the newly written quarantine pair.
• Package metadata allowed mcp>=1.2.0 without the required <2 compatibility bound.

Fix

• Fail before projection replacement when an existing projection cannot be backed up.
• Pass the newly committed quarantine pair as protected during post-commit eviction.
• Bound MCP dependencies in pyproject.toml and requirements.txt, with a metadata regression test.

Validation

• PYTHONPATH=src python3 -m pytest tests/test_registry_ssot.py::test_apply_merge_preserves_projection_when_backup_read_fails -q (RED before fix, GREEN after)
• PYTHONPATH=src python3 -m pytest tests/test_security_regressions.py::test_quarantine_never_evicts_newly_committed_pair -q (RED before fix, GREEN after)
• PYTHONPATH=src python3 -m pytest tests/test_package_metadata.py -q (RED before dependency bound, GREEN after)
• python3 -m compileall -q src/scp && git diff --check && PYTHONPATH=src python3 -m pytest tests/test_registry_ssot.py tests/test_registry_fetch_r4.py tests/test_security_regressions.py tests/test_package_metadata.py -q -> 60 passed
• Full suite after installing optional antigen extras: 380 passed / 3 skipped / 3 pre-existing failures (contract hash baselines and RT11 authority residual).