fix(mcp): pin mcp<2.0.0 and report fastmcp removal accurately

[erensh27]

Fixes #333.

Two fixes:

1. pyproject.toml — cap the mcp extra at mcp<2.0.0: mcp 2.0.0 (released 2026-07-28) removed mcp.server.fastmcp, so fresh skillspector[mcp] installs could resolve mcp 2.x and then fail at server init.
2. src/skillspector/mcp_server.py — on import failure, first check whether mcp itself is importable. If it is, the problem is the missing mcp.server.fastmcp submodule (mcp>=2.0.0), so the error now says so and points at pip install 'skillspector[mcp]' for a compatible pin, instead of the misleading "optional 'mcp' dependency is missing" message.

Reproduction from the issue now yields a truthful error under mcp 2.x, and pip install 'skillspector[mcp]' no longer resolves to mcp 2.x at all.

[rng1995]

Blocking: this catches every ModuleNotFoundError raised while importing FastMCP, including a missing transitive dependency inside an installed MCP 1.x package. Importing top-level mcp then succeeds and the code falsely reports that MCP 2.x removed FastMCP. Distinguish exc.name == "mcp", exc.name == "mcp.server.fastmcp", and unrelated missing modules, preserving the original error for the last case, and add tests for both incompatible-MCP and transitive-import failures.

[rng1995]

[Automated SkillSpector Review]

Requesting changes. The new error branch misdiagnoses missing transitive imports inside installed MCP 1.x as the MCP 2.x FastMCP removal, and the dependency change leaves uv.lock stale (uv lock --check fails). This branch also conflicts with main and substantially overlaps already-approved PR #339, which includes the lock and a focused regression.

[erensh27]

All review comments addressed:

• Blocking: the error branch now distinguishes exc.name == "mcp" (missing extra), exc.name == "mcp.server.fastmcp" (installed but incompatible, mcp>=2.0.0), and unrelated missing modules — the original error is preserved for the last case via raise exc.
• Tests: added coverage for all three failure modes (missing extra, incompatible install, transitive-import failure) in tests/unit/test_mcp_server.py.
• Conflict/stale lock: rebased on main. main already carries the mcp<2.0.0 pin and matching uv.lock (merged via release snapshots), so this PR no longer touches pyproject.toml/uv.lock — uv lock --check passes and the diff is now only the diagnostic fix + tests.

Verified: pytest -m "not integration and not provider" tests/ → 1939 passed; ruff check/format clean. Ready for re-review.

[rng1995]

Thank you for addressing the review feedback, including the improved ModuleNotFoundError.name distinction and the transitive-import regression coverage.

We’re closing this PR to avoid maintaining two competing implementations for the same MCP compatibility work. The supported mcp<2.0.0 bound is already present on main, and #339 remains the selected PR path for the remaining FastMCP compatibility diagnostic and focused test. If that path is updated, the latest distinction implemented here—missing mcp, missing mcp.server.fastmcp, and unrelated transitive import failures—should be preserved.

Thanks again for the quick and careful revision.