feat: track pyproject.toml and uv.lock

[okcodes]

Settles the Python projects backlog entry the way it asked to be settled —
by measurement, not discussion.

The experiment the entry specified

put a project in sandbox/py/, bump the version by hand, run uv lock, and
diff. If the only change is the project's own version, the lock is trackable
on exactly the terms Cargo.lock and package-lock.json are.

Exactly one line changed, and uv lock afterwards produced a byte-identical
file. So the entry is computable with no network and no knowledge of the
dependency graph, which is the standard the other locks are held to.

A uv workspace turned out to be the Cargo shape rather than the npm one —
one entry per member in a shared lock, keyed by the name each manifest declares.
That is the pairing vump already implements, so workspaces needed nothing new.

What differs from Cargo

One thing: Cargo records a source for what it fetched and none for what it
built; uv records one for both and marks the local ones editable. The shared
[[package]] machinery now takes that as a predicate.

That distinction is load-bearing, not cosmetic — a published release of a
workspace member appears in the lock under the member's own name, so the name
filter alone cannot tell them apart. My first test for this passed with the
predicate deliberately broken; the one that replaced it fails properly.

A version named in dynamic is refused: PEP 621 means a build backend computes
it, and the lock omits the version line entirely in that case.

Sandbox

sandbox/py/single-project, verified against real uv:

$ vump minor --allow-nested
OK   1.0.0 -> 1.1.0
  pyproject.toml
  uv.lock

$ uv run python -m demo
demo 1.1.0

The demo reads its version from installed metadata rather than repeating it in
source, so the sandbox does not quietly demonstrate a second place a version can
go stale. Covered by both sandbox guard tests.

Also here

Detection and the refusal that lists the alternatives were two hand-written
sets that had already drifted once — and the test guarding them was a third
hand-written set with the same weakness. All three collapse onto one list, and
the message is generated from it.

The Declarative version-file formats entry named pyproject.toml and
*.csproj as its motivation. Both are now built in, neither costing more than
a day, which is evidence against that entry rather than for it — recorded
there.

🤖 Generated with Claude Code