Maintenance sweep: pinecone-text

[jhamon]

Tracking issue for the maintenance audit of pinecone-text (repo-audit skill, PIN-2 Tier-2 baseline). Substantive items are child issues; trivia are bare checkboxes here. Children auto-tick as their PRs close.

At audit time: v0.11.0 (== PyPI latest), Dependabot open alerts 0, code-scanning open alerts 2, CI/CD/docs workflows present, test suite present (unit/system/contrib).

Theme 1 — Discoverability & Presentation

• Add repo topics (none set): e.g. pinecone, nlp, bm25, splade, sparse-embeddings, python
• Set repo homepage URL (currently empty) — point at docs or PyPI
• Normalize LICENSE.txt → LICENSE (optional: GitHub already recognizes it as Apache-2.0, so cosmetic)
• Confirm community-health coverage (no CONTRIBUTING.md/CODE_OF_CONDUCT.md/SECURITY.md in repo) — rely on org .github defaults or add own

Theme 2 — Cleanup & Repo Hygiene

• Commit poetry.lock for reproducible CI installs (dependency hygiene baseline) #92 Commit poetry.lock for reproducible CI installs
• Complete and align pyproject.toml package metadata #96 Complete and align pyproject.toml package metadata

Theme 3 — Testing + CI Foundation

• Bump pinned GitHub Actions to current major versions #93 Bump pinned GitHub Actions to current major versions
• Add a build/packaging smoke test to CI #94 Add a build/packaging smoke test to CI

Theme 4 — Dependency Hygiene

• Dependabot open alerts: 0 (no action) — fleet critical/high Dependabot is owned by the separate Security fast-track
• Upgrade cohere v4 → v7 and refresh outdated dev-dependency pins #95 Upgrade cohere v4 → v7 and refresh dev-dep pins (depends on Commit poetry.lock for reproducible CI installs (dependency hygiene baseline) #92 + existing tests)

Theme 5 — Security

• Add least-privilege permissions to CI.yaml and CD.yaml workflows #91 Add least-privilege permissions to CI.yaml and CD.yaml (resolves both open code-scanning alerts)

Theme 6 — Docs

• Fix README doc drift: typos, malformed support link, stale Beta banner #97 Fix README doc drift: typos, malformed support link, stale Beta banner

Theme 7 — UX & Small Correctness

• No new items filed. Pre-existing bug reports remain (e.g. [Bug] Potential BM25 Implementation Discrepancy: Missing (k1 + 1) Multiplier #90 BM25 (k1+1) multiplier, BM25Encoder.default() Fails to download stopwords on a cert error #74/[Bug] Not working with nltk  #81 nltk stopwords download) — out of maintenance-sweep scope, left with their existing bug triage.

Safety-net ordering

Discoverability/cleanup (#96, trivia) and safe CI/security items (#91, #93, #94) first. The reproducible-lockfile baseline (#92) precedes the risky major upgrade (#95); #95 also relies on the existing tests/ suite as its safety net.