fix(upstream): make managed.Client config access atomic (MCP-770)

The first MCP-770 fix routed Manager-side reads (DiscoverTools, GetStats,
GetTotalToolCount, ListServers) through GetConfig(), but the underlying
hazard is broader: managed.Client.Config is a pointer field that SetConfig
swaps off m.mu (reconcile add path), while it is read concurrently from many
sites that do NOT hold the client's mc.mu — including Client.Connect's
unlocked phase (client.go:197) and detached state-change callback goroutines
(onStateChange, spawned by StateManager.SetError). The CI -race detector
flagged the Connect-vs-SetConfig variant on PR #555's macOS unit job after
the first fix was cherry-picked.

A mutex-guarded accessor can't cover this: most internal readers run while
mc.mu is already held, so routing them through an RLock GetConfig() would
deadlock (sync.RWMutex is not reentrant). Instead make the field itself
lock-free and data-race-free:

- Replace the exported `Config *config.ServerConfig` field with an
  unexported `cfg atomic.Pointer[config.ServerConfig]`.
- GetConfig() returns cfg.Load(); SetConfig() does cfg.Store(). Both are
  lock-free and safe whether or not mc.mu is held.
- Route every reader through GetConfig() across the managed client, the
  upstream Manager, and the supervisor actor pool.

Add TestConnect_ConfigRace: drives AddServerConfig (SetConfig) against
Client.Connect concurrently; trips -race on the old field, green after.

Verified: go test -race ./internal/upstream/... ./internal/runtime/... and
the original CI victims TestHandleUpstreamServers_AddFromRegistry_HappyPath /
_AdminAllowed_WriteOps pass x5 under -race; build + linter clean.

Related: MCP-770

Author: Dumbris

internal/runtime/supervisor/actor_pool.go

@@ -211,12 +211,12 @@ func (p *ActorPoolSimple) GetAllStates() map[string]*ServerState {
 
 		state := &ServerState{
 			Name:      name,
-			Config:    client.Config,
-			Enabled:   client.Config.Enabled,
+			Config:    client.GetConfig(),
+			Enabled:   client.GetConfig().Enabled,
 			Connected: connected,
 		}
 
-		if client.Config.Quarantined {
+		if client.GetConfig().Quarantined {
 			state.Quarantined = true
 		}
 

internal/runtime/supervisor/actor_pool_complex_reference.go

@@ -16,10 +16,10 @@ import (
 // ActorPool manages the lifecycle of server actors and provides stats for Supervisor.
 // This replaces UpstreamAdapter with direct Actor integration (Phase 7.2).
 type ActorPool struct {
-	actors   map[string]*actor.Actor
-	mu       sync.RWMutex
-	logger   *zap.Logger
-	manager  *upstream.Manager // Use existing manager for client creation
+	actors  map[string]*actor.Actor
+	mu      sync.RWMutex
+	logger  *zap.Logger
+	manager *upstream.Manager // Use existing manager for client creation
 
 	// Event aggregation
 	eventCh   chan Event
@@ -218,12 +218,12 @@ func (p *ActorPool) GetServerState(name string) (*ServerState, error) {
 
 	state := &ServerState{
 		Name:      name,
-		Config:    client.Config,
-		Enabled:   client.Config.Enabled,
+		Config:    client.GetConfig(),
+		Enabled:   client.GetConfig().Enabled,
 		Connected: client.IsConnected(),
 	}
 
-	if client.Config.Quarantined {
+	if client.GetConfig().Quarantined {
 		state.Quarantined = true
 	}
 
@@ -258,12 +258,12 @@ func (p *ActorPool) GetAllStates() map[string]*ServerState {
 		connected := client.IsConnected()
 		state := &ServerState{
 			Name:      name,
-			Config:    client.Config,
-			Enabled:   client.Config.Enabled,
+			Config:    client.GetConfig(),
+			Enabled:   client.GetConfig().Enabled,
 			Connected: connected,
 		}
 
-		if client.Config.Quarantined {
+		if client.GetConfig().Quarantined {
 			state.Quarantined = true
 		}
 
@@ -328,9 +328,9 @@ func (p *ActorPool) forwardActorEvents(name string, a *actor.Actor) {
 			ServerName: name,
 			Timestamp:  event.Timestamp,
 			Payload: map[string]interface{}{
-				"connected":    event.State == actor.StateConnected,
-				"state":        string(event.State),
-				"actor_event":  string(event.Type),
+				"connected":   event.State == actor.StateConnected,
+				"state":       string(event.State),
+				"actor_event": string(event.Type),
 			},
 		})
 	}

internal/upstream/client_test.go

@@ -309,7 +309,7 @@ func TestClient_Headers_Support(t *testing.T) {
 			require.NotNil(t, client)
 
 			// Test that headers are stored in config
-			assert.Equal(t, tt.headers, client.Config.Headers)
+			assert.Equal(t, tt.headers, client.GetConfig().Headers)
 
 			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
 			defer cancel()