build: migrate to uv and ruff, vendor the bump workflow

[lewisjared]

Pull request

Please confirm that this pull request has done the following:

• Tests added
• Documentation added (where applicable)
• Example added (either to an existing notebook or as a new notebook, where applicable)
• Changelog in '/changelog' added

Summary

Migrates the project tooling from Poetry to uv, makes ruff the sole
linter/formatter, re-implements the version-bump workflow using the same process
as climate-resource/github-actions (vendored locally), and modernises the
supported Python / dependency floors.

Packaging & linting

• pyproject.toml: Poetry → PEP 621 [project] + [dependency-groups] (PEP 735), build backend hatchling, static version, committed uv.lock. Extras preserved.
• ruff is now the only formatter/linter ([tool.ruff.lint]/[tool.ruff.format], target-version = py311). Removed black, blackdoc, .pylintrc, .bandit.yml; folded .coveragerc into pyproject.toml.

Vendored bump workflow

• New composite actions .github/actions/setup-uv and .github/actions/bump-version; bump.yaml rewritten to use them (uv version --bump + towncrier). Old Poetry setup action removed.
• Behavioural note: the bump action now lands a post-tag pre-release commit on main (e.g. v0.20.0 → 0.20.1.dev0), matching the reference process.

Python support & dependency floors

• Dropped Python 3.10 → requires-python = ">=3.11". Python 3.10's last xarray release (2025.6.1) predates pandas-3 support (which needs xarray >=~2025.12), so 3.10 cannot work with the modern pandas/numpy stack.
• Raised floors: xarray>=2025.12 (first pandas-3-compatible) and scipy>=1.13 (first numpy-2-compatible). CI / install matrices and classifiers updated to 3.11–3.13. The test-xarray-versions job now guards the xarray floor (the old 0.18.2/2025.0x entries couldn't work with pandas 3).

Workflows / docs / hooks → uv

• ci.yaml, release.yaml, deploy.yaml, .readthedocs.yaml, Makefile, .pre-commit-config.yaml (ruff + ruff-format + uv-lock) all migrated. liccheck runs via scripts/check-licences.sh + liccheck.ini (it can't parse our PEP 621 pyproject directly).

Bug fix bundled in

• ScmRun.from_nc under pandas ≥ 2.1 / 3.0: stack() no longer drops all-NaN entries, so the densified netCDF grid produced spurious timeseries (and Index contains duplicate entries with an _id dimension). Now drops empty dimension combinations and timeseries explicitly. All 108 netcdf tests pass.

Verification

• uv lock/uv sync/uv build (ships py.typed); uv version --bump flow; towncrier draft — OK.
• ruff check + ruff format --check clean; pre-commit run --all-files passes; actionlint clean on the new workflows. Lock resolves a single coherent stack (pandas 3.0.3, xarray 2026.4, numpy 2.4.6, scipy 1.17.1).

Known pre-existing failures (dependency drift, out of scope here)

1. ~13 processing tests fail because pandas 3 now returns a DatetimeIndex (datetime64[us]) where the tests' hardcoded expected frames use object dtype — stale test expectations.
2. Licence check flags GPL/LGPL/unknown packages (iam-units, psycopg, scse-toolkit, …) pulled transitively via pyam-iamc → ixmp4. The check mechanism is fixed; the policy decision (allowlist vs. constrain pyam-iamc) is left open.