fix(docker): eliminate venv, use system python with uv

[fyzanshaik-atlan]

Summary

Replaces the multi-stage venv-based Dockerfile with a single-stage system install using uv, mirroring how the pyatlan base image itself is built.

Problem

The current Dockerfile:

1. Uses a separate builder stage (ghcr.io/astral-sh/uv:python3.11-bookworm-slim) to create a venv and install packages
2. Copies the venv into the pyatlan runtime image
3. Requires a symlink hack because the builder's python path (/usr/local/bin/python) doesn't exist in the runtime image (/usr/bin/python3)
4. Bundles pip, setuptools, and wheel inside the venv — these carry 2 HIGH vulnerabilities from vendored dependencies:
   • jaraco.context 5.3.0 — CVE-2026-23949 (path traversal via malicious tar archives)
   • wheel 0.45.1 — CVE-2026-24049 (privilege escalation via malicious wheel files)
5. Duplicates ~95 packages already available at the system level in the pyatlan base image

Solution

The pyatlan base image (registry.atlan.com/public/pyatlan:main-latest) already provides at the system level:

• pyatlan, pydantic, httpx, cryptography, authlib, h11, anyio, cffi, jinja2, pytz, pyyaml, python-dateutil, tenacity
• uv package manager

Only MCP-specific packages are missing: fastmcp, uvicorn, and their transitive deps (mcp, starlette, websockets, etc.).

The new Dockerfile:

• Single stage — no builder, no multi-stage copy
• No venv — installs directly to system python with uv pip install --system
• --no-deps for the project itself to avoid re-installing packages already in the base image
• No pip/setuptools/wheel — eliminates both vendored vulnerability findings

Before → After

	Before	After
Stages	2 (builder + runtime)	1
Venv	Yes (with symlink hack)	No
pip/setuptools/wheel	Bundled in venv	Not present
Trivy HIGH/CRITICAL	2	0
Dockerfile lines	39	28
Build time	~15s	~6s

Scan results

$ trivy image --severity HIGH,CRITICAL atlan-mcp-server:clean
0 HIGH/CRITICAL vulnerabilities found

Test plan

• docker build succeeds (single stage, ~6s)
• All runtime imports verified: fastmcp 2.14.5, uvicorn 0.40.0, pyatlan 8.5.2, pydantic 2.12.5, cryptography 46.0.5, starlette 0.52.1
• Server starts with SSE transport, Uvicorn running on 0.0.0.0:8000
• Trivy scan: 0 HIGH/CRITICAL