[dandye]

Summary

Stacked on top of #328 (fix__secops-splat-imports) so only the verification delta is shown.

• Explicit AST submodule import & @server.tool() audit (server/secops and server/gti):
  • Adds _audit_secops_tools_exports (server/secops/tests/test_secops_tools_unit.py) and _audit_gti_tools_exports (server/gti/tests/test_tools.py) to inspect all tools/*.py files on disk via ast.parse and verify:
    1. Every public function/constant defined in tools/<submodule>.py is explicitly imported via from .<submodule> import ... in tools/__init__.py and listed in sorted tools.__all__, reporting file.py:lineno on any missing import or export.
    2. Every @server.tool() decorated function in tools/*.py is registered on server._tool_manager._tools (both on standard module import and when running server.py as __main__).
    3. Every public function in server/secops/secops_mcp/tools/*.py carries @server.tool() (requiring internal helpers to be prefixed with _).
• Negative unit tests for unimported functions:
  • Adds test_tools_init_flags_unimported_new_function (server/secops/tests/test_secops_tools_unit.py) and test_gti_tools_init_flags_unimported_new_function (server/gti/tests/test_tools.py) verifying that appending a new @server.tool() function to a tools/*.py module without importing it in tools/__init__.py is immediately flagged with the exact filename, line number, and symbol name.
• GitHub Actions pytest workflow (.github/workflows/verify-tool-exports.yml):
  • Installs server/secops and server/gti and runs pytest tests/*_unit.py -v (server/secops, 41 tests) and pytest tests/ -v (server/gti, 61 tests) on every pull request so the unit tests are the single source of truth.

Verification

• pytest server/secops/tests/*_unit.py (41 passed)
• pytest server/gti/tests/ (61 passed)