WIP: Upgrade python tooling and deps

[philippb]

Summary

• move CI from Travis to GitHub Actions with .python-version (3.12.12)
• modernize dev requirements and add sdiff to requirements.txt
• bump beautifulsoup4 to 4.14.3 for Python 3.12 compatibility
• harden HtmlReporter and add tests for reports + parser errors

Testing

• venv/bin/flake8 validator tests
• venv/bin/pytest -q

Related PRs

• KeepSafe/translation-real-time-validaton#57
• KeepSafe/ks-markdown#13

[philippb]

Fresh compatibility audit on the exact current PR state:

• Base: master at 1fb4602785c849e812769c5edcd75445f7c5152c
• Head: wip/python-deps-2026 at 54953b50a4cebbc3255ab5f25d22092757e33017
• Merge base is current master (0 behind / 10 ahead), so no rebase was needed.

Decision: leave open and do not merge; compatibility confidence 4/10.

The migration is still needed: the base pin is Python 3.6.8, whose final release page says Python 3.6 no longer receives security updates (https://www.python.org/downloads/release/python-368/). This PR's Python 3.12.12 pin is already superseded by 3.12.13 (https://www.python.org/downloads/release/python-31212/).

Draft PR #39 is now the more complete migration branch: it covers current packaging/CI/docs and has fresh green CircleCI prepare, lint, and test jobs. PR #38 also leaves the README's Python requirement inconsistent with setup.py, and its declared content-validator entry point still fails because validator.main is absent.

Fresh proof:

• Isolated base environment: Python 3.6.15, make test passed 62 tests with 1 skip.
• Isolated PR environment: Python 3.12.12, make test passed 65 tests with 1 skip; pytest -q, compileall, CLI help/version/no-argument paths, and dependency checks also passed.
• The direct base-vs-PR comparator ran the same 173 fixture, validator, parser, filesystem, URL, reporter, generated-report-byte, stdout/stderr, return-value, and error cases on both branches. Result: 143 exact matches and 30 raw mismatches.
• Repeating both sides under multiple PYTHONHASHSEED values showed that 7 mismatches are pre-existing hash-order variation on both branches. Another 16 are Python-version exception representation/module-name changes. The remaining 7 are concrete reporter/output changes:
  • an empty HTML report now creates the output directory;
  • Markdown and real-fixture report bytes change (for example, 3,085 bytes / 04e297... becomes 3,063 bytes / 36b1d5...);
  • mixed and URL-only reporter paths change from AttributeError: 'UrlDiff' object has no attribute 'other' to successful report generation;
  • the directory=None failure diagnostic changes.
• The PR declares fail_under = 96, but fresh make coverage fails: 90% is below 96%. The green GitHub Actions workflow runs only pytest -q; it never runs coverage report, so it does not enforce the declared floor.

Local retained evidence is under artifacts/item-4/, especially base/make-test.json, target/make-test.json, target/make-coverage.json, and parity/{base-signature,target-signature,mismatches,nondeterminism}.json.

Smallest next action:

1. Carry the exact reporter-byte cases and coverage finding into PR Upgrade to Python 3.11 #39 instead of repairing two migration branches.
2. Explicitly approve or correct the seven reporter/output changes and add exact regression assertions for the intended contracts.
3. Raise measured coverage to the declared 96% and enforce that report in CI.
4. Rerun the retained dual-environment comparator, normalizing only the hash-order fields already proven nondeterministic.
5. After human confirmation, close WIP: Upgrade python tooling and deps #38 as superseded by Upgrade to Python 3.11 #39.

No branch update, draft-state change, close, or merge was performed.