fix(mcp): bounded per-peer mount so one hung peer can't darken the aggregator

[ywatanabe1989]

Problem

The umbrella scitex serve aggregator (src/scitex/_mcp/__init__.py) is the
single MCP surface that will front ALL ~33 packages' tools. At module-load time
it calls register_all_tools(mcp), which iterated the ecosystem registry and
resolved each peer's FastMCP sequentially + synchronously via
importlib.import_module(f"{import_name}._mcp_server").

If ONE peer's _mcp_server import HANGS at init (verified real case:
scitex-todo's store-wedge stalls 20s+ at mcp-start), the whole loop blocks →
scitex._mcp import never completes → every peer's tools go dark. The
aggregator concentrates this cascade 33x versus the current per-server split,
so it must be fixed before fleet-wide deployment.

Fix

Each peer's resolve now runs concurrently in a bounded daemon thread
(_resolve_peers_bounded):

• All threads start at once and are joined against a single shared deadline, so
  total load time is ~max(peer) bounded by the per-peer budget — never the
  sum. A single hung future can't stall collection of the others.
• Daemon threads: a truly-wedged import thread can't block interpreter exit.
• On timeout / exception / hang the peer is SKIPPED with a warning
  (MCP peer '<ns>' resolve timed out ... — its tools will be unavailable this session) and the loop CONTINUES. Healthy peers still mount.
• Budget configurable via SCITEX_MCP_PEER_TIMEOUT (default 8s).
• safe_mount stays on the main thread — only the peer IMPORT is
  slow/hang-prone; the mount is fast and mutates shared parent-server state, so
  it is kept single-threaded to avoid concurrent-mutation races.

Existing BaseException handling in _resolve_peer_mcp is preserved, so a peer
that sys.exit()s or raises ImportError at import is skipped, not fatal.

All prior behavior preserved: _is_enabled env gate, _NAMESPACE_ALIASES,
_SKIP_CATEGORIES, register_peer_extras, register_umbrella_tools, the
mounted-count log, and SCITEX_MCP_USE_<NS>=0 gating. register_all_tools
gains injectable iter_registry / peer_timeout kwargs (defaults unchanged) so
tests can drive the real code path with hand-rolled fixture peers instead of
patching module globals (also satisfies the no-monkeypatch house rule).

Tests — tests/scitex/test_mcp_bounded_mount.py (22 tests, all green)

Real fixture peers written to disk and imported for real (no mocks):

• hung peer (time.sleep(30) at import): _resolve_peers_bounded returns
  within the budget, reports the peer skipped with a "timed out" reason, and the
  co-resident fast peer still resolves to a real FastMCP.
• full register_all_tools path with an injected registry of one fast +
  one hung peer: does not hang (< 20s despite the 30s sleep), hung namespace NOT
  mounted, fast namespace mounted, a warning naming the hung peer is logged
  ("unavailable").
• ImportError peer and sys.exit() peer: skipped, don't block the fast
  peer.
• env gate (SCITEX_MCP_USE_<NS>=0) and _peer_timeout parsing (default /
  override / invalid-fallback).

The whole suite finishes in ~15s even though it imports two 30s-sleep peers —
direct proof the daemon-thread bounding works.

Reviewer notes

• Module-import-time execution: register_all_tools(mcp) still runs at
  src/scitex/_mcp/__init__.py import (line ~255). The fix bounds that call so a
  hung peer degrades to "its tools missing" instead of hanging the import; it
  does not move the call off import time.
• No regression: the 5 pre-existing failures in test_mcp_entrypoint.py
  (io/stats/scholar/figrecipe not installed in the sandbox venv) fail identically
  on pristine develop — environmental, not caused by this change.