feat: stevedore-release-scope hook, and make python hooks actually installable

[blairham]

Adds the shared stevedore-release-scope hook, and fixes the packaging bug that meant no language: python hook in this repo has ever run.

Part of trading#3362 — moving static CI guards to pre-commit. This PR must merge and be tagged v0.3.0 before the trading side lands: trading's config pins rev: v0.3.0, and pre-commit resolves all repos before running any hook, so until the tag exists trading's hooks cannot run locally at all.

service-yaml-check was never runnable

language: python makes pre-commit pip-install this repo and run the hook's entry as a command. service-yaml-check shipped with entry: hooks/service-yaml-check.py and the repo had no build definition, so every consumer's install failed with Directory '.' is not installable. Nothing exercised the install path, so it went unnoticed.

Fixed by adding a pyproject.toml that packages the hooks as pinpredict_hooks with console-script entry points, moving the module into the package, and pointing the hook at the script name. The additional_dependencies: ["pyyaml>=6"] pin goes away — the package declares PyYAML for real.

stevedore-release-scope

Asserts that onboarding or retiring a service does not silently widen the image build contract so that every image in the catalog re-releases. Three surfaces:

• a named service is an image id in .stevedore.yaml and has a sibling chart whose Chart.yaml name matches, keeping a manual services: <id> dispatch resolvable on both release paths;
• docker-release and chart-release receive the same only: selector, so a manual dispatch can never release a different set of images than charts;
• change_detection.shared_paths carries the explicit all-image contract signal and not the paths every onboarding touches anyway (Dockerfile, .dockerignore, *.sln).

Every assertion is opt-in via args, so a repo missing a surface skips it instead of failing, and a repo with no .stevedore.yaml is a clean no-op. All violations are collected and reported in one run rather than failing on the first.

The manual-dispatch selector expression is deliberately not uniform across the org — most repos map services: all to an empty selector, trading maps it to all on purpose — so --expect-selector is opt-in per repo. The docker/chart consistency check runs either way.

Guardrails so this doesn't recur

• .github/workflows/ci.yml — unit tests on 3.9 and 3.13, plus a hook-install job that pip-installs the package, resolves each console script, and pre-commit try-repos every hook against a fixture consumer. That job is the direct regression guard for the failure above.
• .pre-commit-config.yaml — the repo now dogfoods its own gate, including the unit tests. A hook whose tests only run in CI is exactly how service-yaml-check stayed broken.
• README records the repository layout and the console-script rule, and backfills the check-go-version-sync row that landed without one.

Verification

python -m unittest discover -s tests — 15 tests, green. pre-commit run --all-files — all hooks pass.