fix(tooling): advance exact Python dev pins with just update

[acgetchell]

• Resolve direct development tools as one compatible cross-platform set.
• Preserve runtime and build-system dependency requirements.
• Refresh Ruff, Semgrep, Ty, and their compatible transitive dependencies.

Summary by CodeRabbit

• New Features

  • Added automated updates for exact Python development-tool versions.
  • Added separate workflows for updating Cargo dependencies and Python dependencies.
  • Python tool updates now resolve cross-platform versions and apply changes atomically.

• Documentation

  • Clarified dependency update and release preparation instructions.
  • Documented which Cargo and Python tools are updated and which environments remain unchanged.

• Bug Fixes

  • Improved type handling in changelog and command execution utilities without changing runtime behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c45138a7-cf5a-48c5-98f7-29d7de146dea

📥 Commits

Reviewing files that changed from the base of the PR and between 78ba1c2 and 3616ae9.

⛔ Files ignored due to path filters (2)

• Cargo.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (11)

• AGENTS.md
• CONTRIBUTING.md
• docs/RELEASING.md
• justfile
• pyproject.toml
• scripts/README.md
• scripts/postprocess_changelog.py
• scripts/subprocess_utils.py
• scripts/tests/test_justfile_discoverability.py
• scripts/tests/test_update_python_dev_pins.py
• scripts/update_python_dev_pins.py

Included review availability: 2 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

---

📝 Walkthrough

Walkthrough

The PR adds a Python development-pin updater. It validates exact pins, resolves universal versions with uv, applies changes transactionally, integrates the updater into just update-dependencies, and adds tests and documentation.

Changes

Python development pin updates

Layer / File(s)	Summary
Pin parsing and universal resolution scripts/update_python_dev_pins.py	The new module validates project metadata and exact development pins, resolves universal versions with uv, and checks resolver output.
Transactional application and update wiring scripts/update_python_dev_pins.py, justfile, pyproject.toml	The updater applies changed pins together. The dependency workflow invokes it before updating uv.lock and synchronizing the development environment.
Workflow tests, documentation, and declared pins scripts/tests/*, AGENTS.md, CONTRIBUTING.md, docs/RELEASING.md, scripts/README.md, pyproject.toml	Tests cover parsing, resolution, transactions, diagnostics, and recipe discoverability. Documentation and development pins reflect the new workflow.
Static typing annotations scripts/postprocess_changelog.py, scripts/subprocess_utils.py	Existing helpers now use explicit casts for regex results and subprocess results without changing runtime behavior.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to 3616a

This dependency-pin and tooling-update change has no actionable merge-blocking risk remaining and is merge-ready after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant Developer
  participant just
  participant update_python_dev_pins
  participant uv
  participant pyproject.toml
  Developer->>just: Run update-dependencies
  just->>update_python_dev_pins: Update exact Python development pins
  update_python_dev_pins->>uv: Resolve universal latest versions
  uv-->>update_python_dev_pins: Return resolver output
  update_python_dev_pins->>pyproject.toml: Apply changed pins together
  just->>uv: Update lockfile and sync development environment

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 72.41% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 29 functions across 5 files. (6 skipped: 6 unsupported.)	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: updating exact Python development pins through just update.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/automate-python-dev-pin-updates

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.86%. Comparing base (78ba1c2) to head (3616ae9).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #214      +/-   ##
==========================================
- Coverage   97.88%   97.86%   -0.02%     
==========================================
  Files           8        8              
  Lines        5007     5007              
==========================================
- Hits         4901     4900       -1     
- Misses        106      107       +1     

Flag	Coverage Δ
unittests	97.86% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.