identity-probelisted

# Identity Probe Ruff, mypy and pytest all pass on a server that introduces itself to every upstream as a release it stopped being months ago. Schema drift detection does not see it either — the responses are fine, it is the *request* that lies. Run: ```bash python scripts/identity_probe.py --target <path-to-server-repo> python scripts/identity_probe.py --target <path> --installed # artifact-level ``` Exit `0` clean, `1` findings, `2` not a Python MCP repo. Report every line of the output; the categories are independent and one clean category says nothing about the others. ## What `--installed` adds, and why it is the one that counts Without it, only the source tree is checked. With it, the version is resolved from the **installed distribution** — the only evidence about what actually ships. Metadata is written at install time, so an editable install keeps reporting the pre-bump version until someone reinstalls. A repository can be perfectly clean and the running artifact still wrong. If the probe says `not_installed`, say so in the report. "Source checked, artifact not" is a different claim from "verified", and the difference is where this class of bug lives. ## Do not replace this with a grep Three shortcuts fail here, each of them a bug this probe made first: 1. **`grep -i user-agent | grep <version>`** misses a constant split over two lines. That is how one portfolio server kept shipping `0.2.0` through three call sites *after* a fix had been merged and