feat(dockhand): support transitive dependency overrides/constraints in spec.yaml

[JAORMX]

Implements the dependency-override mechanism from #668.

What

Renovate version bumps fail the build-containers Grype gate (--fail-on high --only-fixed) when the bumped package pins/caps a transitive dependency to a vulnerable version. This adds an optional override mechanism to spec.yaml, plumbed into the generated Dockerfile. toolhive needs no changes — its BuildFromProtocolSchemeWithName(..., dryRun=true) returns the Dockerfile as a string, which is the injection seam.

Schema (cmd/dockhand/main.go)

# npx -> npm "overrides"
spec:
  overrides:
    - package: "@modelcontextprotocol/sdk"
      version: "1.26.0"
      reason: "required, auditable justification"

# uvx -> uv "--overrides" requirements file
spec:
  constraints:
    - spec: "fastmcp>=3.2.0"
      reason: "required, auditable justification"

• Overrides []OverrideEntry{Package, Version, Reason} (npx only)
• Constraints []ConstraintEntry{Spec, Reason} (uvx only)
• Reason is mandatory — validation fails otherwise, mirroring security.allowed_issues.
• Overrides are rejected on non-npx protocols; constraints on non-uvx protocols.

Injection

• npx: rewrites the RUN echo '{...}' > package.json step to embed an overrides block (npm honors overrides only from package.json), kept before the npm install step.
• uvx: injects a RUN printf ... > /tmp/uv-overrides.txt step before the install step and adds --overrides /tmp/uv-overrides.txt to the uv tool install invocation. The install line is matched by content, ignoring comment lines that merely mention uv tool install.

Verification (end-to-end: dockhand-generated Dockerfile -> docker build -> grype --fail-on high --only-fixed)

PR	Override	Result
#469	npm override @modelcontextprotocol/sdk 1.26.0	SDK resolves to 1.26.0; grype gate passes (exit 0)
#527	uv constraint fastmcp>=3.2.0	fastmcp 3.4.0; import mcp_clickhouse OK; grype gate passes
#528	uv constraint fastmcp>=3.2.0	fastmcp 3.4.0; import mcp_neo4j_cypher OK; grype passes — but crosses upstream's deliberate <2.14 cap (major 2->3); functional testing of the neo4j tools is required before relying on it.

go build ./..., go vet, go test ./cmd/dockhand/..., and golangci-lint run ./cmd/dockhand/... all pass.

Follow-up

This PR only adds the mechanism — it does not modify the three renovate spec.yaml files. After this merges to main, each renovate PR (#469, #527, #528) needs to be rebased on main and have its override/constraint block added to its spec.yaml.

Refs #668

🤖 Generated with Claude Code

[toolhive-release-app]

🔒 MCP Security Scan Results

✅ adb-mysql-mcp-server

• Status: Passed
• Tools scanned: 3
• Result: No security issues detected

---

Summary: Scanned 1 MCP server(s), all passed security checks. ✅

[toolhive-release-app]

🛡️ Skill Security Scan Results

⚠️ No skills were scanned in this PR.

[danbarr]

Picking this up since it had been sitting a while, and the mcp 2.0.0 release made it urgent: adb-mysql-mcp-server started failing the build-containers smoke test canary because it depends on mcp[cli]>=1.8.0 with no upper bound, and mcp 2.0.0 removed the mcp.server.fastmcp module it imports at startup. This branch is the fix for that, so it now carries a spec that actually uses the mechanism.

Merged main rather than rebasing, so @JAORMX's original commit and @samuv's review threads stay intact and anchored.

Added on top of the original commit:

• 5d7d2c5 harden the injection against template drift. The anchors match toolhive's generated Dockerfile, but the tests only exercised hand written samples that mirror it, so drift would pass tests and silently ship an image with no overrides applied. This surfaced a live bug: toolhive's uvx.tmpl now conditionally emits its own flags between uv tool install and the quoted package spec (RuntimeConfig.BuildWith renders as --with '<spec>'), which the old uv tool install " anchor did not match at all. Also changed the npm path to parse the package.json toolhive emits and add the overrides key to it, instead of rebuilding it from hardcoded name and version, which would have silently dropped any field toolhive added. New tests inject into Dockerfiles generated by the pinned toolhive version, with and without build time constraints.
• 6544e87 reapply uvx overrides during the security scan. Addresses @samuv's P1 for uvx; see that thread for the npx reasoning.
• c699147 quote override values interpolated into the Dockerfile. Addresses P2, and extends the same fix to the npm path, which had the identical flaw. Details in that thread.
• 126f50f the adb-mysql-mcp-server fix itself. Since the original PR deliberately left spec.yaml changes to follow-ups, no server was exercising the mechanism yet and CI reported "No MCP servers were scanned". With this spec included, the override path now gets real coverage in CI rather than only unit tests.

Verification: go build ./..., go vet ./..., go test ./cmd/dockhand/..., and golangci-lint run ./cmd/dockhand/... all clean. The adb container builds with mcp==1.29.0 and starts with its tools and resources activated. The scan passes for both adb-mysql-mcp-server with mcp<2 and mcp-clickhouse 0.3.0 with fastmcp>=3.2.0.

This supersedes #827, which took the narrower approach of wiring through toolhive's native --build-with flag. That only adds a resolvable constraint, so it cannot force past an upstream pin, which is the case #668 actually needs. Closing it in favor of this.