Release: keep TestPyPI sdist verification source-exclusive without PEP 517 dependency failure

[jeffhuber]

Problem

The v1.4.0 release runbook downloads the TestPyPI sdist with a TestPyPI-only pip command. Although the command uses --no-deps, pip still prepares PEP 517 metadata and tries to obtain the declared setuptools>=77 build requirement from TestPyPI. TestPyPI does not carry that dependency, so the sdist verification stops after publication.

The v1.4.0 release was safely completed by downloading the exact wheel and sdist URLs from the TestPyPI version API, verifying their advertised SHA-256 values, and rehearsing the exact local wheel with dependencies resolved separately from canonical PyPI.

Proposed change

• Keep the candidate query TestPyPI-only; do not add production PyPI as an extra index.
• Install the declared build requirement into the disposable release environment from canonical PyPI.
• Download the sdist with that environment and --no-build-isolation --check-build-dependencies.
• Make the runtime TestPyPI candidate download wheel-only with --only-binary :all: so qualification fails clearly if the universal wheel is unavailable.
• Document the wheel-only runtime boundary and the separate sdist verification step.

Acceptance criteria

• TestPyPI wheel qualification succeeds in a fresh environment without setuptools.
• TestPyPI sdist verification succeeds after its declared build backend is installed separately from canonical PyPI.
• No candidate command uses --extra-index-url or allows production PyPI to supply code-mower.
• Missing wheels, missing build requirements, unexpected artifacts, and version mismatches fail closed.
• Update command assertions in tests/test_migration_rehearsal.py.
• Update runbook assertions in tests/test_release_hygiene.py.
• Migration-focused tests, release-hygiene tests, release readiness, Ruff, and git diff checks pass.

Estimated implementation and exact-head validation effort: 2–4 hours.

[jeffhuber]

Work order: Hosted Devin stabilization implementation

Implement the acceptance criteria on devin/960-testpypi-sdist as one bounded PR. Use the Code Mower remote-session lifecycle with a 5-ACU cap. Stop after opening the PR and reporting its exact head; an independent merge-authority reviewer will audit that head.

[jeffhuber]

Delivered by hosted Devin in #964.

• Builder head: d6edd41
• Merge commit: db22b1f
• Binding verified: repository, sole closing issue, bot author ID, branch, base, and exact head
• Focused builder validation: 994 tests, release readiness, Ruff, and diff check
• Independent exact-head reviews: Codex PASS, Claude PASS
• CI/package/containment and code-mower/gate: pass
• Post-merge main: release readiness passed; 395 focused migration/release-hygiene tests passed; repository-source Ruff and diff checks passed
• Timing: dispatch to PR 668 seconds; PR to merge 314 seconds
• Lifecycle: the session waited for user after opening the PR, so the orchestrator sent one completion instruction and one post-merge cancellation; termination was then verified. No duplicate create and no manual code takeover.
• Observed ACU and dollar cost: pending billing observation; missing values remain unavailable rather than zero.