Modularize CLI into a package and add tiered conformance checks

- Split monolithic cli.py (1020 lines) into teaagent/cli/ package with
  separate parser modules: _agent_parsers, _mcp_parsers, _memory_parsers,
  _misc_parsers, _model_parsers, plus __init__ and __main__
- Move is_loopback_host to mcp_http and enforce non-loopback security at
  the library level in build_mcp_http_server
- Add tiered conformance (smoke/contract) with per-check granularity:
  non-empty response, exact content match, system prompt adherence, and
  token budget reporting
- Simplify setup.py to delegate to pyproject.toml

Author: johnteee

docs/p2-scope.md

@@ -3,20 +3,20 @@
 ## Included
 
 - In-memory Graph RAG primitives for entity/relation traversal and document retrieval.
-- Restricted Code Mode for deterministic local data manipulation with AST allow-list validation and child-process timeout/resource guardrails.
+- Restricted Code Mode with AST allow-list validation running in a child-process sandbox with CPU-time, wall-clock timeout, and best-effort memory limits (RLIMIT_AS/RLIMIT_CPU via `resource`). Container/VM-level isolation is still deferred.
 - Stateless MCP request/response envelopes that carry capabilities and shared state per request.
-- Streamable HTTP transport for the MCP server with `Mcp-Session-Id` sessions, bearer-token/OAuth guardrails for non-loopback binds, and Origin allowlist (POST/GET/DELETE on `/mcp`).
+- Streamable HTTP transport for the MCP server with `Mcp-Session-Id` sessions, bearer-token/OAuth guardrails for non-loopback binds enforced at both the CLI and library level (`build_mcp_http_server` raises `ValueError` when bound to a non-loopback host without auth), and Origin allowlist (POST/GET/DELETE on `/mcp`).
 - Managed-agent readiness checks for tool metadata, audit, budget, external state, and HITL gaps.
 - Provider portability checks for tool calling, structured output, system prompt support, prompt caching, and context limits.
-- Cross-provider live model conformance smoke checks with per-provider pass/fail/skip reporting.
+- Cross-provider live model conformance with layered `smoke` (non-empty response) and `contract` (exact content match, system-prompt adherence, token-budget reporting) tiers via `run_tiered_conformance`.
 
 ## Still Deferred
 
 - Production GraphQLite deployment, migrations, and Cypher query tuning.
-- Strong production sandboxing for Code Mode using containers, V8 isolates, or a managed execution service.
+- Strong production sandboxing for Code Mode beyond the current child-process guardrails: containers, seccomp profiles, V8 isolates, or a managed execution service.
 - Production hardening for OAuth 2.1 / DPoP deployments, including key rotation and external client storage.
 - Actual managed runtime integration with Anthropic, OpenAI, Google ADK, or Vertex Agent Engine.
-- Deeper cross-provider conformance for streaming, structured output, tool calling, and provider-specific safety blocks.
+- Extended cross-provider conformance tiers for streaming, structured output, tool calling, latency budgets, and provider-specific safety/block taxonomy.
 
 ## P2 Extension Rules
 

setup.py

@@ -1,37 +1,6 @@
-from __future__ import annotations
+from setuptools import setup
 
-from setuptools import find_packages, setup
-
-GRAPHQLITE_DEPS = ['graphqlite>=0.4.4', 'pysqlite3>=0.6.0']
-OAUTH_DEPS = ['cryptography>=3.4']
-TELEMETRY_DEPS = [
-    'opentelemetry-api>=1.20',
-    'opentelemetry-sdk>=1.20',
-    'opentelemetry-exporter-otlp-proto-http>=1.20',
-]
-DEV_DEPS = [
-    *GRAPHQLITE_DEPS,
-    *OAUTH_DEPS,
-    *TELEMETRY_DEPS,
-    'pytest>=7',
-    'pytest-cov>=4',
-    'ruff>=0.4',
-    'mypy>=1',
-]
-
-
-setup(
-    name='teaagent',
-    version='0.1.0',
-    description='Minimal P0 agent harness with governance-first defaults.',
-    packages=find_packages(),
-    python_requires='>=3.9',
-    install_requires=[],
-    extras_require={
-        'graphqlite': GRAPHQLITE_DEPS,
-        'oauth': OAUTH_DEPS,
-        'telemetry': TELEMETRY_DEPS,
-        'dev': DEV_DEPS,
-    },
-    entry_points={'console_scripts': ['teaagent=teaagent.cli:main']},
-)
+# All project metadata and dependencies are declared in pyproject.toml.
+# This stub exists only for legacy editable-install compatibility with
+# tools that do not yet support PEP 517/660 without a setup.py present.
+setup()