chore: migrate to shared tooling 3.2

.changeset/toolchain-3.md

@@ -0,0 +1,4 @@
+---
+---
+
+Adopt shared tooling 3.2 with the matched Oxlint plugin/checker and regenerated development setup.

.claude/settings.json

@@ -10,7 +10,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "if [ \"${CLAUDE_CODE_REMOTE:-}\" = \"true\" ]; then\n  cloud_setup_incomplete() {\n    printf '%s\\n' 'Cloud setup could not establish a verified session environment. From the repository root, run bash .agents/cloud-setup.sh install and then bash .agents/cloud-setup.sh start. Do not assume pinned tools or services are ready until start succeeds.'\n    printf '%s\\n' \"cloud-setup: $1\" >&2\n    exit 0\n  }\n  if [ -n \"${CLAUDE_ENV_FILE:-}\" ]; then\n    cloud_session_exports=\"$(bash \"$CLAUDE_PROJECT_DIR/.agents/cloud-setup.sh\" session)\" || cloud_setup_incomplete 'startup failed; run install'\n  else\n    bash \"$CLAUDE_PROJECT_DIR/.agents/cloud-setup.sh\" start >&2 || cloud_setup_incomplete 'startup failed; run install'\n    exit 0\n  fi\n  if [ -n \"${CLAUDE_ENV_FILE:-}\" ]; then\n    if [ ! -s /etc/profile.d/stll-cloud.sh ]; then\n      cloud_setup_incomplete 'cloud shell profile is unavailable; run install'\n    fi\n    cloud_shell_exports=\"$(cat /etc/profile.d/stll-cloud.sh)\" || cloud_setup_incomplete 'cloud shell profile could not be read; run install'\n    [ -n \"$cloud_shell_exports\" ] || cloud_setup_incomplete 'cloud shell profile is unavailable; run install'\n    if [ -e \"$CLAUDE_ENV_FILE\" ] || [ -L \"$CLAUDE_ENV_FILE\" ]; then\n      [ -f \"$CLAUDE_ENV_FILE\" ] && [ ! -L \"$CLAUDE_ENV_FILE\" ] || cloud_setup_incomplete 'session environment must be a regular file; check its path and rerun start'\n    fi\n    cloud_env_snapshot=\"${CLAUDE_ENV_FILE}.stll-cloud\"\n    case \"$cloud_env_snapshot\" in\n      *\"'\"*) cloud_setup_incomplete 'session environment path must not contain a single quote; check its path and rerun start' ;;\n    esac\n    if [ -e \"$cloud_env_snapshot\" ] || [ -L \"$cloud_env_snapshot\" ]; then\n      [ -f \"$cloud_env_snapshot\" ] && [ ! -L \"$cloud_env_snapshot\" ] || cloud_setup_incomplete \"session environment snapshot must be a regular file; remove $cloud_env_snapshot and rerun start\"\n    fi\n    if [ -n \"$cloud_session_exports\" ]; then\n      cloud_session_exports=\"$cloud_session_exports\n$cloud_shell_exports\"\n    else\n      cloud_session_exports=\"$cloud_shell_exports\"\n    fi\n    cloud_env_temporary=\"$(umask 077; mktemp \"${cloud_env_snapshot}.XXXXXX\")\" || cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'\n    printf '%s\\n' \"$cloud_session_exports\" > \"$cloud_env_temporary\" || { rm -f -- \"$cloud_env_temporary\"; cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'; }\n    mv -f -- \"$cloud_env_temporary\" \"$cloud_env_snapshot\" || { rm -f -- \"$cloud_env_temporary\"; cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'; }\n    [ -f \"$cloud_env_snapshot\" ] && [ ! -L \"$cloud_env_snapshot\" ] || cloud_setup_incomplete \"session environment snapshot must be a regular file; remove $cloud_env_snapshot and rerun start\"\n    cloud_env_source=\". '$cloud_env_snapshot'\"\n    if [ ! -f \"$CLAUDE_ENV_FILE\" ] || ! grep -Fqx -- \"$cloud_env_source\" \"$CLAUDE_ENV_FILE\"; then\n      printf '\\n%s\\n' \"$cloud_env_source\" >> \"$CLAUDE_ENV_FILE\" || cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'\n    fi\n  fi\nfi"
+            "command": "if [ \"${CLAUDE_CODE_REMOTE:-}\" = \"true\" ]; then\n  cloud_setup_incomplete() {\n    printf '%s\\n' 'Cloud setup could not establish a verified session environment. From the repository root, run bash .agents/cloud-setup.sh install and then bash .agents/cloud-setup.sh start. Do not assume pinned tools or services are ready until start succeeds.'\n    printf '%s\\n' \"cloud-setup: $1\" >&2\n    exit 0\n  }\n  if [ -n \"${CLAUDE_ENV_FILE:-}\" ]; then\n    cloud_session_exports=\"$(bash \"$CLAUDE_PROJECT_DIR/.agents/cloud-setup.sh\" session)\" || cloud_setup_incomplete 'startup failed; run install'\n  else\n    bash \"$CLAUDE_PROJECT_DIR/.agents/cloud-setup.sh\" start >&2 || cloud_setup_incomplete 'startup failed; run install'\n    exit 0\n  fi\n  if [ -n \"${CLAUDE_ENV_FILE:-}\" ]; then\n    if [ ! -s /etc/profile.d/stll-cloud.sh ]; then\n      cloud_setup_incomplete 'cloud shell profile is unavailable; run install'\n    fi\n    cloud_shell_exports=\"$(cat /etc/profile.d/stll-cloud.sh)\" || cloud_setup_incomplete 'cloud shell profile could not be read; run install'\n    [ -n \"$cloud_shell_exports\" ] || cloud_setup_incomplete 'cloud shell profile is unavailable; run install'\n    if [ -e \"$CLAUDE_ENV_FILE\" ] || [ -L \"$CLAUDE_ENV_FILE\" ]; then\n      [ -f \"$CLAUDE_ENV_FILE\" ] && [ ! -L \"$CLAUDE_ENV_FILE\" ] || cloud_setup_incomplete 'session environment must be a regular file; check its path and rerun start'\n    fi\n    cloud_env_snapshot=\"${CLAUDE_ENV_FILE}.stll-cloud\"\n    case \"$cloud_env_snapshot\" in\n      *\"'\"*) cloud_setup_incomplete 'session environment path must not contain a single quote; check its path and rerun start' ;;\n    esac\n    if [ -e \"$cloud_env_snapshot\" ] || [ -L \"$cloud_env_snapshot\" ]; then\n      [ -f \"$cloud_env_snapshot\" ] && [ ! -L \"$cloud_env_snapshot\" ] || cloud_setup_incomplete \"session environment snapshot must be a regular file; remove $cloud_env_snapshot and rerun start\"\n    fi\n    if [ -n \"$cloud_session_exports\" ]; then\n      cloud_session_exports=\"$cloud_session_exports\n$cloud_shell_exports\"\n    else\n      cloud_session_exports=\"$cloud_shell_exports\"\n    fi\n    cloud_env_temporary=\"$(umask 077; mktemp \"${cloud_env_snapshot}.XXXXXX\")\" || cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'\n    printf '%s\\n' \"$cloud_session_exports\" > \"$cloud_env_temporary\" || { rm -f -- \"$cloud_env_temporary\"; cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'; }\n    mv -fT -- \"$cloud_env_temporary\" \"$cloud_env_snapshot\" || { rm -f -- \"$cloud_env_temporary\"; cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'; }\n    [ -f \"$cloud_env_snapshot\" ] && [ ! -L \"$cloud_env_snapshot\" ] || cloud_setup_incomplete \"session environment snapshot must be a regular file; remove $cloud_env_snapshot and rerun start\"\n    cloud_env_source=\". '$cloud_env_snapshot'\"\n    if [ ! -f \"$CLAUDE_ENV_FILE\" ] || ! grep -Fqx -- \"$cloud_env_source\" \"$CLAUDE_ENV_FILE\"; then\n      printf '\\n%s\\n' \"$cloud_env_source\" >> \"$CLAUDE_ENV_FILE\" || cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'\n    fi\n  fi\nfi"
           }
         ]
       }

.github/workflows/autofix.yml

@@ -15,4 +15,4 @@ permissions:
 
 jobs:
   dependabot-bun-dedupe:
-    uses: stella/.github/.github/workflows/dependabot-bun-dedupe.yml@5764ab66e4df84cfd2e642c7d7e4678261e668f8
+    uses: stella/.github/.github/workflows/dependabot-bun-dedupe.yml@ba5f7da76aededf6f22814de93c72a49843fcc8e

.github/workflows/ci.yml

@@ -147,7 +147,7 @@ jobs:
         with:
           bun-version-file: package.json
       - run: bun install --frozen-lockfile
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - name: Install pinned cross-language oracle packages
         run: |
           uv venv .venv --python python3
@@ -289,7 +289,7 @@ jobs:
       - run: bun run smoke:wasm
       - run: bun run smoke:browser
       - run: bun run readme:check
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - name: Build the Python abi3 wheel
         uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:

.github/workflows/cla.yml

@@ -26,7 +26,7 @@ jobs:
           || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'
         )
       )
-    uses: stella/.github/.github/workflows/cla.yml@8f19eb7220047e5b06f6e75f0b9f908bfd01f5f6
+    uses: stella/.github/.github/workflows/cla.yml@ba5f7da76aededf6f22814de93c72a49843fcc8e
     with:
       allowlist: dependabot[bot],renovate[bot],github-actions[bot],google-labs-jules[bot],cursoragent,stella-provenance-updater[bot],autofix-ci[bot]
     secrets:

.github/workflows/quarantine-policy.yml

@@ -15,4 +15,4 @@ jobs:
     if: github.repository == 'stella/stdnum'
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/quarantine-policy.yml@df2659b7ccaa9cb69e69a99787fd4e2180db5893
+    uses: stella/.github/.github/workflows/quarantine-policy.yml@ba5f7da76aededf6f22814de93c72a49843fcc8e

.github/workflows/quarantine-prune.yml

@@ -13,7 +13,7 @@ jobs:
     if: github.repository == 'stella/stdnum'
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/quarantine-prune.yml@df2659b7ccaa9cb69e69a99787fd4e2180db5893
+    uses: stella/.github/.github/workflows/quarantine-prune.yml@ba5f7da76aededf6f22814de93c72a49843fcc8e
     secrets:
       CHANGELOG_APP_ID: ${{ secrets.CHANGELOG_APP_ID }}
       CHANGELOG_APP_PRIVATE_KEY: ${{ secrets.CHANGELOG_APP_PRIVATE_KEY }}

.github/workflows/release-policy.yml

@@ -18,6 +18,6 @@ permissions:
 jobs:
   enforce:
     name: Enforce release boundaries
-    uses: stella/.github/.github/workflows/release-policy.yml@38c67ddd7ca18eec2996f4c2e5b99e5cd80def08
+    uses: stella/.github/.github/workflows/release-policy.yml@ba5f7da76aededf6f22814de93c72a49843fcc8e
     permissions:
       contents: read

.github/workflows/release-pr.yml

@@ -17,7 +17,7 @@ jobs:
       contents: read
       pull-requests: read
       checks: read
-    uses: stella/.github/.github/workflows/changeset-release-pr.yml@5764ab66e4df84cfd2e642c7d7e4678261e668f8
+    uses: stella/.github/.github/workflows/changeset-release-pr.yml@ba5f7da76aededf6f22814de93c72a49843fcc8e
     with:
       bun-version-file: package.json
       sync-cargo-inherited-lock: true

.github/workflows/release.yml

@@ -334,7 +334,7 @@ jobs:
       id-token: write # Required only for PyPI trusted publishing.
     steps:
       - name: Prepare exact Python wheel set
-        uses: stella/.github/.github/actions/pypi-publish-hardened@38c67ddd7ca18eec2996f4c2e5b99e5cd80def08
+        uses: stella/.github/.github/actions/pypi-publish-hardened@ba5f7da76aededf6f22814de93c72a49843fcc8e
         with:
           expected-version: ${{ needs.verify.outputs.version }}
           project-name: stella-stdnum
@@ -347,7 +347,7 @@ jobs:
           packages-dir: dist
           skip-existing: true
       - name: Verify published PyPI files
-        uses: stella/.github/.github/actions/pypi-publish-hardened/verify@38c67ddd7ca18eec2996f4c2e5b99e5cd80def08
+        uses: stella/.github/.github/actions/pypi-publish-hardened/verify@ba5f7da76aededf6f22814de93c72a49843fcc8e
         with:
           expected-version: ${{ needs.verify.outputs.version }}
           project-name: stella-stdnum
@@ -356,7 +356,7 @@ jobs:
     name: Finalize release
     needs: [verify, pack-native, pack-portable, publish-pypi]
     if: github.ref == 'refs/heads/main' && (needs.verify.outputs.publish == 'true')
-    uses: stella/.github/.github/workflows/npm-version-finalize.yml@38c67ddd7ca18eec2996f4c2e5b99e5cd80def08
+    uses: stella/.github/.github/workflows/npm-version-finalize.yml@ba5f7da76aededf6f22814de93c72a49843fcc8e
     with:
       package-files: |
         packages/stdnum/package.json