Build: migrate to uv

[elliot-100]

This PR:

• Migrates from poetry to uv for package management - and along with that, to a standard 'PEP621' pyproject.toml. Amends 3 of the 4 CI workflows, and Dependabot

• Commits the uv.lock lockfile to the repo for reproducible dev/CI builds (NB this has no effect on package locking for consumers)

• Moves /spond to /src/spond which is the preferred file layout for uv and makes it more difficult to e.g. run tests on stale code

  • while it's possible to move to uv without doing this, it would require additional build configuration

@Olen please can you review and let me know if I've missed anything

Detail

Dependency versions

• Uses the lowest-direct dependency resolution strategy for the lockfile. i.e. the lowest compatible versions for aiohttp, while using the latest compatible versions for all other dependencies. This avoids the chore of updating indirect deps.

• Pins all dev/CI dependencies to exact versions for reproducibility (was just ruff previously) - while with lowest-direct this isn't strictly necessary, I think it makes intent clearer

• We don't need the python = "<4" constraint for pdoc with uv

CI

• A specific version of uv (latest, 13.0) is installed using a specific commit of astral-sh/setup-uv, as per uv docs recommendation
• Python continues to be installed with actions/setup-python. While it's possible to do this with uv, it's not a great fit for CI - slower and blocks GitHub caching (but we're not using that yet)
• python-package.yml adds an extra check asserting that the lockfile is current
• publish-docs.yml now uses the installed version of the package, as tests do. While they should be the same in a CI run, this helps expose build misconfiguration issues

Version pinning during development

• Developers can use a .python-version file to ensure uv uses a specific version of Python for their environment, e.g. if fixing an issue on an old version. This PR adds that file to .gitignore to prevent it being committed - it's not relevant to the library itself

[elliot-100]

[RESOLVED] @Olen I forgot in workflows/python-package.yml to ensure that the repo's lockfile is used as is with uv run ... --frozen, uv run ... --locked or similar. Have to add that later.

[elliot-100]

[RESOLVED] Also, publish_docs.yml uses the local version of spond, but it should use the installed version as tests do. While they should be the same in a CI run, this could hide build misconfiguration issues

[elliot-100]

OK, I think this is ready for initial review @Olen.

There is one outstanding migration issue I haven't resolved yet: in release.yml the project version is retrieved with VERSION=$(poetry version -s). However uv doesn't have an -s equivalent to give a bare version number.

Looks like it needs a bit of code to get it from uv version --output-format json's version field.

Alternatively, to get it from pyproject.toml.