fix(deps): remediate setuptools GHSA-xmj3-9gf7-h52w #787

The frozen graph on dev and the retained 0.55.11 patch select setuptools 84.0.0. A fresh strict audit on 26 October 2026 rejected that version for GHSA-xmj3-9gf7-h52w.

Upstream identifies versions from 38.2.2 through 84.0.0 as affected and 84.1.0 as patched. The issue affects Windows legacy wheel installation through namespace_packages.txt and can create a fixed-content init.py outside the intended destination. This report does not claim remote code execution.

Primary sources, accessed 26 October 2026:

• GHSA-xmj3-9gf7-h52w
• https://github.com/pypa/setuptools/releases/tag/v84.1.0

This is a follow-up to #780 and draft dev PR #786. Preserve the official package, existing dependency ranges, all three strict subject audits, and exact MCP/OpenTelemetry exception boundaries. Do not add an advisory exception.

Acceptance requires genuine failing-before audit evidence, official setuptools 84.1.0 or a separately reviewed patched release, normal frozen lock/export regeneration, compatibility and license checks, passing strict audits, independent review, normal hooks and required CI. Keep original native evidence and mappings immutable. No merge or publication is authorized.