fix: keep Feed parsing inside Core runtime boundary

[kachofugetsu09]

Summary

• replace the in-process Content source RSS parser dependency with xml.etree.ElementTree
• preserve RSS and Atom title, content, link, author, id, and timestamp extraction
• keep feedparser private to the MCP environment instead of requiring it in Core

Verification

• 58 passed
• production FreshPluginImporter probe with feedparser explicitly unavailable
• pyright feed_runtime/backend.py: 0 errors
• python -m compileall -q feed_runtime/backend.py
• git diff --check