Address review: mixed scope + pyproject comment cleanup

- Fix em dash and long inline comment in pyproject.toml (ASCII-only per
  repo style)
- PR title and body updated to reflect mixed docs+fix scope (audit
  uncovered a real XXE hardening on metric_item.MetricItem.from_response,
  plus a fragile transitive-import cleanup in server_info_item.py)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jacalata

pyproject.toml

@@ -13,7 +13,9 @@ license-files = ["LICENSE"]
 readme = "README.md"
 
 dependencies = [
-    'defusedxml>=0.7.1',  # latest as at 7/31/23; use for all XML parsing — stdlib xml is unsafe against XXE. XML building (Element/SubElement/tostring) still uses stdlib as defusedxml has no equivalents.
+    # defusedxml: parse all incoming XML (stdlib xml.etree is XXE-unsafe).
+    # XML building (Element/SubElement/tostring) still uses stdlib; defusedxml has no builder equivalents.
+    'defusedxml>=0.7.1',  # latest as at 7/31/23
     'packaging>=23.1',   # latest as at 7/31/23
     'requests>=2.32',  # latest as at 7/31/23
     'urllib3>=2.6.0,<3',