Add guardrails for LinkML's compatibility constraints

[ericprud]

LinkML asked that PyShEx releases not break compatibility, keep up with current Python versions, and not add unexpected heavyweight dependencies. This PR adds automated checks for all three.

What's added

• tests/test_contract freezes the public API: signatures, exports, CLI options and exit codes. It also replays the exact calls of the known PyPI clients, linkml and jupyter-rdfify 1.0.4. The tests are self-contained, so they also run against the built wheel.
• tests/test_policy checks the runtime dependency closure in uv.lock against an allowlist. It rejects version caps and requires imports to match declared dependencies. It keeps Python versions consistent across classifiers, the CI matrix and tox, and flags a CPython release left unsupported for more than 90 days.
• .github/scripts/api_compat.py diffs the API against the previous release with griffe. A break needs the breaking-change label on the PR, or a major version bump at release (minor while 0.x).
• New CI jobs:
  • policy runs the pre-commit hooks and the API diff.
  • downstream installs this tree with the latest linkml and jupyter-rdfify in one resolution and runs their usage.
  • python-next is a non-blocking early warning for the next Python release.
  • A weekly schedule runs the whole workflow.
• The release workflow now verifies the built wheel before publishing.
• Pre-commit hooks are installed with uvx pre-commit install.

Fixes

• CI push trigger now targets master; it previously targeted main, so pushes to master never ran CI.
• Added py314 to tox env_list.
• Added pytest config so a checked-out shexTest submodule doesn't break test collection.

Findings not addressed here

• The existing codespell step checks nothing, because tox runs codespell ''.
• Validation bug: { ex:knows . * ; ex:knows . + } accepts a node with no ex:knows triples.
• Python 3.15.0b1 crashes importing chardet's compiled extension, which comes in via pyshexc. pyjsg also uses a typing call that 3.15 disallows.
• Undeclared imports: pyshex imports rdflib, pyjsg and jsonasobj but doesn't declare them. It declares chardet and urllib3 but never imports them. The tests record these as known exceptions.

After rebasing on #109 and #105

• Current uv: the pinned uv is now 0.12.18. The old pin made the "3.14" jobs run a 3.14 beta.
• python-next: a failure now shows as a warning rather than a red check.
• Windows: the policy tests now read files as UTF-8.
• API check: it uses griffe's Python API and ignores "attribute value changed" reports, which flag refactorings rather than interface changes.
• pyshexc from a fork: EXTENDS validation with feasibility-pruned partition search #105 installs pyshexc from a fork through [tool.uv.sources]. The policy tests allow this by name on pull requests. The release workflow sets PYSHEX_RELEASE_CHECK=1, which refuses it, so nothing can be published until that pyshexc is on PyPI.

🤖 Generated with Claude Code