Run transport security tests in process instead of over sockets

The SSE and StreamableHTTP security tests each spawned a uvicorn
subprocess on a port picked by bind-then-close, then polled until the
port accepted connections. Under pytest-xdist two workers can pick the
same port in that window: the second server fails to bind, the
readiness poll succeeds against the other worker's server, and the test
asserts against a server configured with different security settings
(e.g. 421 for a host the test explicitly allowed).

Rewrite both files to drive the same Starlette apps in process through
the interaction suite's StreamingASGITransport (re-exported from
tests.interaction.transports as the sanctioned import point): no
sockets, no subprocesses, no ports to race over. Assertions are
unchanged. The new in-process GET test covers the validation-failure
return in _handle_get_request; the pragma on that line was already
stale (the success path has been driven in process by the interaction
suite since it merged) and is removed.

Also deflake test_idle_session_is_reaped, which slept 0.1s after a
0.05s idle timeout and failed on slow runners when the reaper had not
fired yet. Re-requesting the session to poll for the 404 would push its
idle deadline forward, so instead wait on the manager's "idle timeout"
log record, which is emitted synchronously with the session being
unregistered.

Author: maxisbey

src/mcp/server/streamable_http.py

@@ -669,7 +669,7 @@ async def _handle_get_request(self, request: Request, send: Send) -> None:
             await response(request.scope, request.receive, send)
             return
 
-        if not await self._validate_request_headers(request, send):  # pragma: no cover
+        if not await self._validate_request_headers(request, send):
             return
 
         # Handle resumability: check for Last-Event-ID header

tests/interaction/transports/__init__.py

@@ -0,0 +1,9 @@
+"""Transport-specific interaction tests, and the in-process streaming bridge they are built on.
+
+`StreamingASGITransport` is re-exported here as the sanctioned import point for test code
+outside this suite (the bridge module itself is suite-private).
+"""
+
+from tests.interaction.transports._bridge import StreamingASGITransport
+
+__all__ = ["StreamingASGITransport"]