ci: shared tests and tag-only publish, version from Cargo.toml

[singlerider]

What changed

• Publishing removed from rust-tests.yml and python-tests.yml. Both used to publish on every stable push with long-lived tokens.
• python-tests.yml and rust-tests.yml call the shared workflows in blacklanternsecurity/CLA at one pinned SHA. The Python matrix comes from requires-python, replacing the literal 3.9 to 3.14 list. ruff format --check now runs (only ruff check did before), and the extension is built with maturin develop. Rust runs --all-features --locked on the rust-toolchain.toml channel. actions-rs/toolchain is gone.
• publish.yml runs on v* tags only: shared release-check.yml validates the tag against Cargo.toml, then rust and python tests run, then the wheel matrix and sdist build, then crates.io and PyPI upload, then shared publish.yml creates the GitHub Release with the SPDX JSON SBOM and the wheels attached.
• crates.io uses trusted publishing (rust-lang/crates-io-auth-action), so CARGO_REGISTRY_TOKEN is no longer stored. PyPI uses OIDC in the pypi environment.
• Cargo.toml is the single version source. pyproject.toml declares dynamic = ["version"] and maturin fills it in.
• Dead poetry.lock and .flake8 removed. README code blocks formatted so ruff format --check passes.
• Every workflow has permissions:, every action is SHA-pinned, and the CLA caller uses the shared SHA. Builds on ci: pin the runner image and the branch-ref actions #92.

Required checks: python / passed, rust / passed.

Validation

$ cargo fmt --all -- --check && cargo clippy --all-targets --all-features --locked -- -D warnings && cargo test --all-features --locked
test result: ok. 72 passed; 0 failed; 2 ignored
test result: ok. 9 passed; 0 failed; 0 ignored
$ uv run ruff check -q && uv run ruff format --check -q
ruff check + format --check: clean (ruff 0.16.9)
$ uv run pytest -q
14 passed in 1.12s
$ uv run python -c "import importlib.metadata as m; print(m.version('radixtarget'))"
4.2.0
$ uvx --from actionlint-py actionlint
(no findings)

Admin steps

• Register trusted publishers: PyPI (workflow publish.yml, environment pypi) and crates.io (workflow publish.yml, environment release). Then delete the PyPI and crates.io token secrets.

Related issues

• Part of blacklanternsecurity/bbot-enterprise#139
• Part of blacklanternsecurity/bbot-enterprise#140
• Part of blacklanternsecurity/bbot-enterprise#149
• Part of blacklanternsecurity/bbot-enterprise#155
• Part of blacklanternsecurity/bbot-enterprise#156

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100%. Comparing base (e26e924) to head (0ba31d0).

Additional details and impacted files

@@         Coverage Diff         @@
##            dev    #96   +/-   ##
===================================
  Coverage   100%   100%           
===================================
  Files         3      3           
  Lines       604    605    +1     
===================================
+ Hits        604    605    +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[liquidsec]

This will mean anyone with write access can publish. This needs to be discussed.