Use the Python module entrypoint in the user service, prepare the MCP optional runtime before restart, and serve the configured vault path instead of the repo root.
Verify binary asset resources use an octet-stream MIME type and cover service vault resolution in tests.