build: keep dev-only packages out of the standalone binary

[ehe9991]

Problem

The standalone parallel-cli binaries ship dev-only packages. release.yml installs with uv sync --extra cli, which also installs the default dev group (ipykernel, tach, ty, pyinstaller). rich.jupyter and rich.live lazily import IPython.display, and PyInstaller follows that import into whatever is installed. A local build of main bundles IPython, ipykernel, jupyter_client, tornado (6.5.5, 10 advisories), zmq, debugpy, jedi and psutil: 1,819 modules, 42.3 MB.

None of it is reachable from CLI flows, since rich only uses IPython inside a Jupyter kernel. It still ships to users, and scanners flag it.

The same step runs uv pip install pyinstaller>=6.0.0 unquoted: the shell treats > as a redirect, so it installs an unpinned, unlocked PyInstaller.

Solution

• Add a build dependency group (pyinstaller>=6.20.0). In release.yml, install with uv sync --locked --extra cli --no-default-groups --group build, so PyInstaller comes from uv.lock with hashes.
• Run the build with uv run --no-sync. A plain uv run re-syncs the default dev group and would undo the fix.
• uv.lock changes are environment markers only; no package versions move.

Testing

• Local build on darwin-arm64 with the new install command: 1,317 modules, 31.0 MB (zip 23.0 → 17.4 MB). IPython, ipykernel, jupyter_*, tornado, zmq, debugpy, jedi, parso, psutil and traitlets are gone. --version and the --help of auth, search, extract, enrich, enrich run and research all work.
• setuptools is still bundled, by PyInstaller's own runtime hook. chore(deps): bump vulnerable dev-only tooling #160 bumps it.
• PR CI green (tests, lint, cli-test).
• ⚠️ Not run in Actions: the five-platform matrix runs only on release. Dispatch release.yml with a test tag, or check the next RC.

🤖 Generated with Claude Code