Centralize project configuration and streamline releases

[banesullivan]

Summary

Centralize project configuration in pyproject.toml, switch to uv-based workflows, and adopt tag-driven releases via setuptools_scm + PyPI trusted publishing. No long-lived secrets remain in CI.

Details

Configuration consolidation

• Deleted setup.py, MANIFEST.in, .flake8, requirements.txt, requirements_test.txt, requirements_style.txt.
• pyproject.toml now holds project metadata, build backend, ruff, pytest, coverage, codespell, and setuptools_scm config.
• Dev/test dependencies moved into PEP 735 [dependency-groups] (test, dev).
• Moved FUNDING.yml under .github/.

Versioning and release

• setuptools_scm with version_file = 'scooby/_version.py' and version_scheme = 'release-branch-semver', mirroring pyvistaqt.
• Push a tag and release.yml builds, verifies the wheel version matches the tag, and publishes to PyPI.
• actions/checkout uses fetch-depth: 0 and explicit fetch-tags: true to avoid the known tag-push edge case.

CI and security

• All workflows run through uv (astral-sh/setup-uv).
• PyPI via OIDC trusted publishing (pypa/gh-action-pypi-publish, environment pypi). Codecov via use_oidc: true. CODECOV_TOKEN and PYPI_API_TOKEN removed; no secrets referenced in .github/.
• Codecov comments disabled.

Tooling

• Single linter/formatter: ruff. Removed black, isort, flake8, pydocstyle.
• Pre-commit expanded with pre-commit-hooks basics (trailing whitespace, end-of-file-fixer, check-toml/yaml, merge-conflict, debug-statements, etc.), prettier, taplo, check-jsonschema for workflow validation, codespell, and zizmor for Actions security linting.
• Added .github/zizmor.yml requiring ref-pinned action references.
• Bumped all actions and pre-commit hooks to latest: checkout@v6, setup-python@v6, setup-uv@v8, upload-artifact@v7, download-artifact@v8, codecov-action@v6, prettier v3.8.3.

Makefile and gitignore

• Every Makefile recipe invokes via uv run / uv sync / uv build.
• .gitignore modernized for uv, ruff, mypy caches and the setuptools_scm-generated _version.py.

External config required for first release

• PyPI trusted publisher: owner banesullivan, repo scooby, workflow release.yml, environment pypi.
• GitHub repo environment named pypi must exist (Settings → Environments).