feat: establish installable CLI foundation and CI gates

[Dyu20705]

Summary

• Establish an installable, typed src/ Python package and minimal runsift CLI.
• Add reproducible uv tooling, package metadata, focused tests, package build verification, and installed-wheel smoke tests.
• Rebase the work onto current main while preserving the maintained documentation, label automation, and GitHub project setup scripts.
• Fix repository hygiene: standard Python .gitignore, tests/ layout, discoverable CONTRIBUTING.md, valid Markdown pull request template, MIT license, one package-version source, and local Markdown-link validation.

Related issues

• Closes [Foundation] Create installable package, source layout, and reproducible toolchain #32
• Refs [CI/CD] Add progressive quality gates for package, static checks, tests, fixtures, and reports #15

Scope

Included

• Python package metadata and Hatchling build configuration.
• src/runsift/ typed package and console entry point.
• Implemented root --help and --version behavior.
• Unit and subprocess integration tests.
• Formatting, linting, strict typing, tests, documentation-link validation, package build, and clean-install smoke gates in CI.
• Python 3.11 development baseline and CI tests on Python 3.11 and 3.14.

Explicitly out of scope

• The analyze, collect, fixtures, and version command groups tracked by [CLI] Implement command surface, configuration, structured errors, and local quickstart #6.
• Input schemas, redaction, parsing, classification, decision policy, and report rendering.
• Release publication or closing the broader CI rollout issue [CI/CD] Add progressive quality gates for package, static checks, tests, fixtures, and reports #15.

Design and contract impact

• Contract impact: adds the installable runsift command with root help and --version only.
• Compatibility impact: requires Python 3.11 or newer.
• Migration required: none; this is the initial package foundation.

Verification

Check	Command	Result
Locked environment	uv sync --frozen	Passed in CI
Formatting	uv run --frozen ruff format --check .	Passed in CI
Linting	uv run --frozen ruff check .	Passed in CI
Type checking	uv run --frozen mypy src	Passed in CI
Tests	uv run --frozen pytest	Passed on Python 3.11 and 3.14
Documentation links	uv run --frozen python scripts/check_markdown_links.py	Passed in CI
Package build	uv build --no-sources	Wheel and sdist passed in CI
Installed-wheel smoke	runsift --help and runsift --version outside the repository	Passed in CI

Local pre-push verification also parsed pyproject.toml, compiled src, tests, and scripts, passed 5 tests, and passed the Markdown-link checker.

Security and data handling

• Workflow permissions are limited to contents: read.
• Checkout credentials are not persisted.
• Third-party actions are pinned to immutable commit SHAs.
• No runtime network dependency or credential handling is introduced.
• The smoke test executes only the installed RunSift entry point with static arguments.

Risks

• This PR deliberately provides only a package/CLI skeleton; it does not implement triage behavior.
• The broader progressive-gate rollout remains owned by [CI/CD] Add progressive quality gates for package, static checks, tests, fixtures, and reports #15 as additional product contracts land.

Rollback

• Restore dev to 890f36b8c3739a47f89d2240cc67250cc1abe54f, preserved as backup/pr-38-dev-20260802.

Reviewer focus

• Package metadata and sdist/wheel contents in pyproject.toml.
• CI reproducibility, action pinning, and clean-install smoke behavior.
• The boundary between implemented root CLI behavior and commands still contracted by [CLI] Implement command surface, configuration, structured errors, and local quickstart #6.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.