fix(ci): batch A - scan/sonarcloud/docker-mcp pre-existing failures

[frankiehot-tech]

Summary

Fixing 4 pre-existing CI failures flagged by the "全部处理" pass:

1. scan (leak-detection) — dual-repo-watch.yml embedded frankiehot-tech
   literals that tripped the private-account leak grep. Replaced with
   descriptive text (no personal-account identifiers).
2. Docker Vulnerability Scan — cryptography>=42.0 ships CVE-2026-69247 /
   CVE-2026-69249. Bumped to cryptography>=50.0 (CVE fixes in 49.0.0/50.0.0).
3. sonarcloud (74 failed) — tests/maref/integration/conftest.py injected
   MagicMock stubs into the global sys.modules at collection time, so any
   unit test importing the real modules (test_aip_adapter,
   test_mcp_hitl_bridge, test_a2a_bridge, ...) received a MagicMock and
   failed. Verified import maref.integration no longer has the circular
   import chain the stubs were guarding against, so the stubs were removed.
   Local run: 350 passed / 236 passed across the affected suites.
4. ci.yml test job timeout — test_list_tools blocked on claude-mem /
   codedepth lazy backend init in CI. Mocked the two lazy accessors so the test
   only asserts the sidecar tool set itself.

Pre-existing failures (NOT in this PR's scope)

• trivy-scan: frontend JS HIGH vulnerabilities (brace-expansion, vite 4.3.0,
  serialize-javascript, fast-uri, colors) — separate task
• license/cla: CLA not yet signed — requires human action on cla-assistant.io
• sonarcloud: any remaining failures beyond the 74 addressed here
• gate-test coverage: separate follow-up

Verification

• pytest tests/maref/integration tests/unit/test_aip_adapter.py ... → 350 passed
• pytest tests/sidecar/test_mcp_bridge.py tests/maref/integration ... → 236 passed
• pre-push oss-check: ✅ passed

Closes the leak-detection / docker-vuln / sonarcloud-stub / test-timeout legs.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Athena seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Athena seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}