ci: move to devenv's modular CI

[ajslater]

Summary

This moves the repo onto devenv's modular CI. bochord and codex are already migrated.

ci.yml is now devenv's standard caller (copy/gha_std):

• CI calls devenv-check.yml:
  • Gate: runs the Release Preflight on main pushes and PRs into main. On a main push it reuses the dist of an earlier run that passed on the same git tree.
  • CI image: built once and pushed by digest.
  • Checks: a fail-fast Lint / Test / Build Dist matrix. Each check pulls that image.
  • Required check: CI / Lint, Test & Build Dist.
• Publish to PyPI runs through the devenv-pypi action, on main pushes and pre-release PRs.
• Release runs devenv-release.yml: tag, GitHub Release from NEWS.md, and merge main back into develop. It runs on main pushes only. Setting the RELEASE_AUTOMATION=off repo variable disables it.

Commits

1. update devenv & deps. The routine devenv update:
   • .circleci lines retired from the ignore files
   • the ESLint base config
   • pyproject template changes
   • dependency bumps
2. ci: move to devenv's modular CI.

bin/hub_prune_stale.py, which devenv's docker feature copies in, is deliberately left out: it needs Python 3.11 (datetime.UTC), and this repo still supports 3.10.

After merge

Switch main's required status check from Lint, Test & Build to CI / Lint, Test & Build Dist.

Test plan

• make fix, make lint (including actionlint on every workflow), make ty and make test pass locally
• Every CI file is byte-identical to devenv's source
• This PR's run:
  • Gate
  • CI Image
  • Lint / Test / Build Dist pull the image and pass
  • CI / Lint, Test & Build Dist is green

🤖 Generated with Claude Code