chore!: modernise tooling, raise the python floor to 3.12 #minor

[nmichlo]

Part of standardising CI and tooling across my repos against
nmichlo/.github.

The release chain could never publish

version-bump.yml tagged on merge; python-publish.yml triggered on tag push. A tag
pushed with GITHUB_TOKEN does not trigger another workflow, so the publish never fired.
Both are replaced by a caller of the shared release.yaml, which owns both triggers in one
run. lint.yaml and test.yaml call the shared workflows too.

Python floor 3.8 -> 3.12

Breaking for downstream consumers. Classifiers and CI matrices updated to match. The
code already used from enum import StrEnum, which needs 3.11 -- so the declared floor was
wrong, not just old.

A real bug in relative-import parsing

_core/module_imports_ast.py crashed on a bare relative import:

from . import x     # -> TypeError: sequence item 1: expected str instance, NoneType found

ast.ImportFrom.module is None for from . import x (it is only set for
from .sub import x), but the code appended it unconditionally before ".".join(...).
Found by ty's invalid-argument-type check on list.append. Fixed, with
tests/test_module_data.py::test_get_module_imports_bare_relative as a regression test.

Given this repo's whole job is parsing imports, that is a good one to have caught.

The self-hook was running 3.12 code under Python 3.9

This repo dogfoods itself. The published hook runs python3 -m pydependence, and -m puts
CWD first on sys.path -- so it was already executing the working copy inside a pinned
release's environment. That environment predates the 3.12 floor, so:

File "pydependence/_cli.py", line 31, in <module>
    from enum import StrEnum
ImportError: cannot import name 'StrEnum' from 'enum' (.../python3.9/enum.py)

Rather than wait for a new tag, the self-hook is now a local hook running the project
venv directly. That is what was effectively happening, minus the version skew, and it
removes the chicken-and-egg of needing a release to lint the code that produces it.

.pre-commit-hooks.yaml also gained language_version: "3.12" so consumers of the
published hook get a correct interpreter.

Two deviations from the shared config, both forced

No uv-lock hook and no committed uv.lock, and ty runs as a local hook rather than
via ty-pre-commit. pyproject.toml's bootstrapped example-legacy extra intentionally
pins pydantic<2, conflicting with pydantic>=2.0.0 in the base dependencies -- it is a
demo of this tool's env=-scoped version resolution, documented in the README, and never
meant to be installed. Any command that resolves the whole project (uv lock, uv sync,
uv check -- which ty-pre-commit shells out to) fails on it by design. uv's conflicts
marking only covers extra-vs-extra, not extra-vs-base. Running ty directly sidesteps
project resolution; uv pip install -e ".[test]" still works, so the shared lint workflow
is unaffected.

Also flagged, not fixed

pyproject.toml has a [tool.pytest] section where pytest expects
[tool.pytest.ini_options] -- as written it is silently ignored. Pre-existing and
unrelated, so left alone.

Testing

• pre-commit run --all-files -> all 10 hooks pass
• pytest -> 20 passed (19 original + 1 new regression test)
• ruff check, ruff format --check, ty check -> clean