feat: modernize to uv + pyproject.toml + src/ layout + python-semantic-release

[farhan]

Important

PR implemented with the assistance of Claude Code, human-reviewed and improved before pushing to code review.

Summary

Modernize codejail to uv + pyproject.toml (PEP 621/735) + src/ layout + python-semantic-release.

Part of openedx/public-engineering#506.

• Replace setup.py/setup.cfg with pyproject.toml (PEP 621 static metadata)
• Switch from pip-compile to uv with PEP 735 dependency groups; commit uv.lock
• Move the package into a src/ layout
• Retain pylint/isort/pycodestyle as on master (ruff deferred to its own epic per #506); coverage config moved into pyproject.toml
• Update tox.ini to use tox-uv with uv-venv-lock-runner
• Update CI to use astral-sh/setup-uv; SHA-pin all actions; add workflow_call trigger; split quality into a dedicated job (runs without Docker)
• Add python-semantic-release + release.yml (OIDC trusted publishing)
• Add commitlint.yml to enforce conventional commit format on all future PRs to this repo
• Update Dockerfile to use uv instead of the deleted requirements/*.txt files

Removed

Deleted files: setup.py, setup.cfg, requirements/, .coveragerc, CHANGELOG.rst, .github/workflows/pypi-release.yml

Removed Makefile targets:

Target	Reason
$(COMMON_CONSTRAINTS_TXT)	Internal pip-compile helper — replaced by edx_lint write_uv_constraints in the upgrade target

Versioning

[Dynamic] setuptools-scm with dynamic = ["version"] — master had a PyPI publish workflow; python-semantic-release controls the version string at release time via git tags.

Testing Notes

This PR has not been manually tested against the repo's own features. Testing relied on CI checks and local agent tooling (make requirements, make quality, python -m build). Note: the test suite requires Docker with AppArmor (as on master) and cannot be run locally without that setup. Repo-owner is encouraged to run the repo's feature tests before merging.

Code reviewer notes:

• CI tests continue to run inside Docker with AppArmor (as on master) — only the quality job was separated out to run on the host using astral-sh/setup-uv. The Docker-based test approach is preserved exactly.
• OIDC trusted publisher must be configured on PyPI before merging — first publish will fail silently otherwise. This is an out-of-band step for the Axim team (Feanil): PyPI project → Publishing → Add a new publisher, pointing at openedx/codejail, workflow release.yml, no environment. The old PYPI_UPLOAD_TOKEN secret can be removed after OIDC is confirmed.
• commitlint.yml is already present on master — conventional commit format is already being enforced. The existing commitlint.yml is unchanged.
• requires-python = ">=3.12" formalizes what the repo already practiced (CI only ran Python 3.12); no support was actually dropped.
• The quality dependency group includes Django>=5.2 and pytest so pylint can import test modules cleanly (consistent with what master's testing.txt provided).

---

🤖 Generated with Claude Code