yank-probelisted

# Yank probe `shipped-probe` asks whether the version users install **right now** is withdrawn. This asks the inverse, across the whole catalogue: > Does a known-unusable, **not**-yanked release still exist, with a healthy > successor beside it? Run: ```bash python scripts/yank_probe.py --target <path> # dist from pyproject.toml python scripts/yank_probe.py --dist zurich-opendata-mcp --format json python scripts/yank_probe.py --dist foo-mcp --index-url https://pypi.example.com/simple python scripts/yank_probe.py --dist foo-mcp --max-versions 200 # long catalogues ``` Exit `0` clean, `2` **findings**, `127` the harness could not run (index unreachable, or the healthy successor's own metadata unreadable — a comparison that did not happen is never a pass). ## Why this is not part of `shipped-probe` `shipped_probe.py --metadata-only` promises **two HTTP requests**, and `nightly-audit.sh` depends on that promise: the metadata pre-run exists so the release verdict survives the full gate hanging, and it only survives because it is cheap. This probe reads every release's `Requires-Dist` and every relevant dependency's version list — O(versions + dependencies) requests. Folding it in would break the exact property the pre-run was added for. It imports `shipped_probe`'s index primitives rather than copying them, the same way `shipped_probe` imports `transport_boot_probe`. ## The incident `zurich-opendata-mcp` 0.5.1 declared `mcp[cli]>=1.28.1` with **no upper bo