Prefer valid distributions when collecting entry points

[gaoflow]

Fixes #534

Summary

• add a duplicate-aware distribution selector for entry_points() that replaces an invalid/empty dist-info entry with a later valid distribution of the same normalized name
• keep normal discovery order for unique distributions, avoiding the broader cost of preferring valid metadata for every distribution
• add a regression test where an empty older foo.dist-info appears before a valid one with entry points

Tests

• Red before the fix: PYTHONPATH=. uv run --python 3.11 --with '.[test]' pytest tests/test_main.py::InvalidMetadataTests::test_entry_points_prefer_valid_distribution -q failed with KeyError: 'main'\n- PYTHONPATH=. uv run --python 3.11 --with '.[test]' pytest tests/test_main.py::InvalidMetadataTests::test_entry_points_prefer_valid_distribution -q\n- PYTHONPATH=. uv run --python 3.11 --with '.[test]' pytest tests/test_main.py::InvalidMetadataTests tests/test_api.py::APITests::test_entry_points tests/test_api.py::APITests::test_entry_points_unique_packages_normalized -q\n- PYTHONPATH=. uv run --python 3.11 --with '.[test]' pytest -q\n- PYTHONPATH=. uv run --python 3.11 --with '.[test,check]' pytest --ruff -q\n- PYTHONPATH=. uv run --python 3.11 --with '.[test,type]' pytest --mypy -q\n- git diff --check\n\nAI assistance was used under my direction.

[rossburton]

I've not tested this but I'm not convinced it will actually work in all cases. Our reason for this is that thanks to package upgrades and removals we'll end up with eg wheel-0.47.0.dist-info/ existing in site-packages, but it will be completely empty.

This is discovered as a distribution, and because metadata() falls back to "parse an empty string" it still has valid metadata, it's just that the metadata is empty. I'm currently hacking a test into pypa/build to check that dist.metadata.name is actually set.

[rossburton]

I take that back, latest importlib_metadata has different behaviour and correctly raises an exception.

[rossburton]

I must admit I don't understand the reasoning behind returning invalid distributions at all: if some empty directories that look like a dist but have no content are found, why return them at all?