perf(pytest): 194s → 4s collection — lazy heavy imports + norecursedirs

Four-part fix for the collection bottleneck that was blocking the dev loop:

1. Lazy mitreattack.stix20 import in attack_stix.py — deferred to first
   _load() call (TYPE_CHECKING guard at top level)

2. Lazy misp_stix_converter import in both MISP export routers — moved
   from module level into the route handler body

3. Lazy attack_catalog / attack_stix in ttp.py repo mixin — thin wrapper
   functions so the import chain never fires at module load time

4. tests/api/conftest.py — `from decnet.web.api import app` moved inside
   the `client()` fixture; `pytest_ignore_collect` broadened to skip all
   test_schemathesis*.py variants (not just test_schemathesis.py), which
   were launching a subprocess server at module-import time

5. pyproject.toml — `norecursedirs` for tests/live, tests/stress,
   tests/service_testing, tests/docker, tests/perf so these directories
   are never entered; `-m` filter removed from addopts (now redundant);
   `--dist loadscope` → `--dist load` to unblock workers immediately

6. behave_core / behave_shell rename — BEHAVE packages dropped the
   `decnet_` prefix; reinstalled editable installs and updated all 14
   import sites across profiler, ttp, bus, and correlation modules

decnet/ttp/attack_stix.py

@@ -38,9 +38,10 @@ from dataclasses import dataclass
 from functools import lru_cache
 from pathlib import Path
 from threading import Lock
-from typing import Final
+from typing import TYPE_CHECKING, Final
 
-from mitreattack.stix20 import MitreAttackData
+if TYPE_CHECKING:
+    from mitreattack.stix20 import MitreAttackData
 
 from decnet.ttp.attack_version import (
     ATTACK_BUNDLE_SHA256,
@@ -231,6 +232,7 @@ def loaded_license_path() -> Path | None:
 
 
 def _load() -> MitreAttackData:
+    from mitreattack.stix20 import MitreAttackData  # heavy — lazy on first call
     global _data, _loaded_path
     with _data_lock:
         if _data is not None:

decnet/ttp/stix_custom.py

@@ -77,7 +77,7 @@ class XDecnetBehaveProfile:
     evidence_ref, identity_ref (optional).
 
     ``schema_version`` matches ``OBSERVATION_SCHEMA_VERSION`` from
-    decnet_behave_shell.spec.envelope — bump when the envelope schema changes.
+    behave_shell.spec.envelope — bump when the envelope schema changes.
 
     ``kd_digraph_simhash`` is the 8-byte digraph SimHash from
     AttackerIdentity, hex-encoded. Null when identity has not been clustered.

decnet/ttp/stix_export.py

@@ -209,7 +209,7 @@ def _threat_actor(
 
     obs_list = observations or []
     if obs_list or kd_hash is not None:
-        from decnet_behave_shell.spec.envelope import OBSERVATION_SCHEMA_VERSION
+        from behave_shell.spec.envelope import OBSERVATION_SCHEMA_VERSION
         profile_id = (
             f"x-decnet-behave-profile--{_uuid.uuid5(_NS, attacker['uuid'])}"
         )