Convert pipeline.py to async, add CLI tests, and document protobuf CVE

[SL-Mar]

Summary

This PR completes the production readiness checklist by converting the remaining blocking network calls in pipeline.py to async, adding comprehensive CLI integration tests, and documenting a known transitive dependency vulnerability.

Key Changes

• Async Network Calls in pipeline.py: Converted requests.get() calls in _fetch_from_arxiv() and _fetch_from_crossref() methods to use aiohttp with proper async/await patterns, eliminating thread pool executors

• CLI Integration Tests: Added 33 new CLI tests in tests/test_cli.py using Click's CliRunner covering:

  • All top-level commands (version, health, search, download, summarize, generate, validate, backtest, config-show)
  • Subcommand groups (auto, library, evolve)
  • Argument validation and help text
  • Error handling and graceful failure modes
  • Mock-based testing for external tool dependencies

• CVE Documentation: Added Section 8 to PRODUCTION_READINESS_REVIEW.md documenting:

  • CVE-2026-0994 in protobuf (transitive dependency)
  • Risk assessment (Low severity for CLI tool context)
  • Monitoring instructions for patch availability
  • Remediation plan for when fix becomes available
  • Risk acceptance rationale

Implementation Details

• Network calls now use aiohttp.ClientSession with 15-second timeouts
• Response handling properly awaits async operations (await response.read(), await response.json())
• CLI tests use environment fixtures to mock API keys and temporary directories
• Tests validate both success and error paths without requiring actual network calls
• Production readiness review updated to reflect completion of all 7 critical items

Testing

All new CLI tests pass with CliRunner and properly mock external dependencies. No breaking changes to existing functionality.